prepared by lancaster university for the health and safety executive 2009 · 2019. 12. 5. ·...

Executive Health and Safety

Risk leadership and organisational type

Prepared by Lancaster Universityfor the Health and Safety Executive 2009

RR756 Research Report



J S Busby & A Collins Lancaster University Management School Lancaster Universtity Lancaster L41 4YX

The anecdotal experience of new entrants in the UK offshore industry is that they are not, as a group, safer or less safe than established organisations. Similarly, the organisational arrangements that are sometimes associated with new entrants – such as the separation of ownership and operation – are not clearly less safe than more traditional arrangements. What seems to matter more is a deeper capacity to make chosen ways of organising work. This particularly involves being ‘rigorous’: not just developing effective safety practices but dealing with the by-products and side-effects of such practices.

An analysis of a set of accident reports, and a set of interviews carried out with HSE inspectors and staff in five offshore operators, produced a detailed account of what this kind of rigour looked like in practice. The analysis also indicated that being rigorous was an organisational practice that itself had by-products needing to be managed. So rigour needs to be seen as a continual practice of being committed to particular actions and at the same time being attentive to the consequences. Rigour of this kind points to a strong emphasis on leadership – leadership that promotes an attention to refining practice that does not seem to come naturally or easily to organisations.

Organisations that were new entrants to the industry faced problems that made particular demands on their capacities to be rigorous. For example, they had to maintain safety while managing transitions in ownership and organisational culture, getting used to new labour market conditions and regulatory requirements, and coping with the physical and organisational legacies inherited from previous owners of an installation. The recommendation is that this concept of rigour becomes a part of the way in which safety management systems are scrutinised.

This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily reflect HSE policy.

HSE Books

© Crown copyright 2009

First published 2009

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner.

Applications for reproduction should be made in writing to:Licensing Division, Her Majesty’s Stationery Office,St Clements House, 2-16 Colegate, Norwich NR3 1BQor by e-mail to [email protected]

ACKNOWLEDGEMENTS

Many thanks are due to all those who gave up their time to be interviewed, and to those who arranged access for us to their organizations. All were generous with their time, went to some trouble to make themselves available, and offered their opinions freely and openly. The costs of the interviews to these organizations were borne by them. As a condition of participation both the individuals and the firms involved in the interviews remain anonymous, but we are very grateful for their help and considerable insight. Particular thanks are due to Rob Miles of the HSE.

ii

12345678910

CONTENTS

Introduction 1Background 4Methods 7Aspects of rigour 11Relationships among the aspects of rigour 26Rigour in new entrants 32Leadership and rigour 37Recommendations 40Conclusion 44References 46

iii

EXECUTIVE SUMMARY

The UK offshore industry has, like certain other industries, seen the entry of new operators: operators with extensive experience elsewhere but new to the UK, and in some cases operators with extensive experience in other roles but new to being a Duty Holder operating with an Offshore Safety Case. The purpose of this study was to investigate what this meant for the safety of offshore operations, and what implications it had for the way HSE scrutinized these operations.

As in other industries, such as aviation, it has been very difficult to find objective evidence on the comparative safety performance of organizations new to the UK offshore sector in relation to established operators. Moreover, new entrants often take over installations formerly operated by established companies. So their immediate safety record can say more about the legacy they inherit than their way of organizing. Even if one group or other were objectively safer, in a goal setting regime a regulator cannot simply impose one way of organizing. Therefore this study focused on process and practice rather than outcome.

In addition, anecdotal evidence did not mark out particular ways of organizing as being less or more safe than others. Having large technical staffs and a strong reliance on rules and procedures was not clearly better or worse than the opposite, for example; and subcontracted activity was not clearly better or worse than in-house activity. Therefore the study looked particularly at the deeper capacities – or ‘rigour’– that organizations exhibited, rather than their chosen ways of organizing. A central aspect of this is that, instead of addressing the direct question of how an organization deals with its circumstances, it addresses the question of how it deals with the needs and by-products of its way of responding to these circumstances. For example, what was most interesting was not whether an organization used high levels of protective redundancy to minimize risk in a particular system, but whether it managed the side-effects of relying on redundancy (or the side-effects of not relying on redundancy).

This involved looking for aspects of rigour in the way people understood both failure and the absence of failure. First, in a relatively small exercise, a set of offshore accident reports was analysed. Second, in a larger exercise, a set of interviews was carried out in HSE, three new entrant operators, and two established operators. Seventy-seven interviews were conducted in all, and both interviews and reports were analysed qualitatively. The result was a description of what it means for an organization to be rigorous in its management of safety: a set of qualities that helped deal with the requirements and by-products of the way an activity was organized. For example, one aspect of rigour was the quality of being ‘situated’: of avoiding the use of over-generalised approaches to dealing with situations that arose from trying to be consistent. However, qualities of this kind have by-products themselves, so rigour needs to be seen as a process of continually dealing with the consequences of the way you work.

Some of these qualities were particularly important to new entrants because they involved transitions in ownership, responsibility or practice. These were most often and most clearly encountered when a new operator acquired an existing installation. Such qualities were evident, in interviewees’ observations, sometimes because they were present and sometimes because they were absent. They provide a basic approach for a scrutinizing body, such as HSE, to look at organizations – whether they are established operators or new entrants – that seems to be equally applicable to all kinds of organization, regardless of the ways of organizing they have chosen. They also have important implications for safety leadership: they point to what it is that leaders need to bring about, in organizing for safety, that does not naturally or inherently exist in organized activity. Such leadership does not need to be exercised by people with formal authority. But it does require an insight into how organizations achieve and fail to achieve

v

safety in a way that gets beyond the shallow and literal understanding of what we think of as the typical resources that organization have in order to achieve safety – like redundancy.

Our recommendation is that the scrutiny of operating organizations’ safety management systems and processes draws on this concept of rigour as managing the by-products of the way you manage safety. It suits a goal-setting approach because it emphasizes not the organizational model that operators choose but their capacity to follow through on the implications of their chosen model and ensure it produces safety. It is an approach that suits all kinds of organization, but naturally suits an industry in which there are new entrants that are making different organizational choices from established companies, and which face additional challenges as a result of their status as new entrants.

iv

1 INTRODUCTION

Recent years have seen the entry of small, low-cost operators without large technical staffs, long historical experience and extensive standards to intrinsically hazardous industries, such as aviation and offshore hydrocarbons extraction. Perhaps unexpectedly there appears not to have been a marked increase in failures – either as near-misses or fully-developed breakdowns. This raises basic questions about whether high reliability organization (Roberts, 1990; La Porte and Consolini, 1991; La Porte, 1996) means adhering to one particular way of organizing, or whether different ways of organizing (for example with highly formal, rule-oriented systems, or with much more informal, more negotiated approaches) can achieve similar levels of reliability. And if different ways of organizing can be equally reliable, what is that makes them equally reliable, and what differentiates reliable from unreliable organizations?

This also raises questions about how regulators deal with hazardous operations. How far, for instance, should they insist on codified practices and standards, how much technical expertise should they expect within the operating organization, and how much can they rely on formal processes of risk assessment? Past studies point to the importance of regulatory inspections in producing the kind of behavior in operating staff that produces high reliability (La Porte and Thomas, 1995), but this probably depends on inspections that support rather than undermine the right kinds of behavior.

The purpose of this study has been to investigate issues of safety surrounding new entrants in the UK offshore industry, and in particular to compare and contrast how new entrants and established operators achieve safe operations. To quite a large extent this has involved looking at the organization on installations that changed ownership, generally passing from established firms to new entrants, often close to the end of the installations’ design lives. We have not, however, tried to measure objectively whether new entrants as a group are safer or less safe than established operators. One problem with trying to do this is that the events of interest – large scale catastrophic failures – are rare. Another is that using proxy outcomes like leaks, or regulatory actions (such as prohibition notes) is not particularly informative. Such outcomes appear to be as much a function of the legacy that current owners may have been left as the way the current owners organize their activity. Two of the more serious failures described by interviewees in our fieldwork concerned systemic vulnerabilities that had been inherited from previous owners of an installation. The same problem has been encountered in studies of other industries where there has been a large influx of new operators, such as the aviation industry following deregulation. Although in aviation (in the US especially) there is a good deal more data on the relative performance of established firms and new operators following deregulation, analysis still seems to be inconclusive (for example Bier et al, 2003; Oster et al, 1992).

Moreover, even if we could somehow determine that (on average) being a new entrant made an operating firm more reliable or less reliable, this knowledge could not easily be acted on. Specific firms may well operate quite differently from the ‘average’ of their group. And firms cannot simply be made into new entrants or established operators, nor simply have the qualities of new or established operators imposed on them. From a regulatory standpoint, if a company is operating within the law the regulator has little basis for telling it to change its nature or practice.

In fact, as suggested at the start, the anecdotal evidence seems to say that there is no one type of organization – whether established or new, whether highly bureaucratized or relatively informal – that is conclusively better. In a small number of interviews that preceded this work, several regulatory inspectors instead pointed to a somewhat vaguer, but deeper, explanation of

1

reliability. This essentially concerned the capacity of organizations to recognize the implications of whatever ways of organizing they had chosen, to refine whatever practices they had chosen, and to ‘follow through’ on their choices. It was less the particular organizational choices they made (for example about whether to subcontract certain activities or operate them internally), and more the thoroughness with which they put those choices into effect. This is not to say that the choices were arbitrary. But the basic feeling was that they were less instrumental in achieving reliability than the capacity to make those choices work. For example, in some cases the organization owning an installation was quite different from the organization that operated it. What mattered to safety, in the experience of some observers at least, was not whether ownership and operation were separated, but whether the consequences of this separation were fully understood and thoroughly managed.

Figure 1 summarises this basic rationale.

Figure 1 Rationale for the research approach

i ( ji )

(l l

i ) a i i l

lizi

di i l

izi igoal- i

i

Di il

iizi

ll i

Outcomes of nterest ma or acc dents are too rare to measure

Proxy measures eg eaks, regu atory act ons are as much funct on of phys caegacy as current way of organ ng

You cannot ctate part cu ar

ways of organ ng n a

sett ng reg me

fferent f rms seem to be ab e to make d fferent ways of organ ng equa y effect ve

Investigation of the deeper capacities that produce safety and their particular application in new entrants

This focus – on the deeper capacities of organizations to follow through on their decisions about how to manage safety – means that we are less concerned with the direct problem of ‘how does an organization manage hazards?’, and more concerned with the indirect problem of ‘how does it deal with the needs and by-products of its own way of responding to these hazards?’. In the case of new entrants there seem to be particular circumstances that they need to be good at dealing with: for example, the legacy problems of taking over existing and sometimes old installations. Our primary interest has been in what happens when new entrants respond to these problems, as shown in Figure 2, and whether they have the capacity to manage this. Such a focus is consistent with the idea that organizations’ ‘encounters with risk’ (Hutter and Power, 2005) are as much encounters with their own limitations and by-products as they are with external threats. Organizations managing risk have to deal with the all the problems that arise from organizing itself, quite apart from the problems that their environments present them with.

2

Figure 2 Capacities for dealing with the problems produced by organization

Circumstances as source of hazard

Organizational response to this

Problems created by organizational

Deeper capacities for dealing with

• Eg legacy of hazard response problems of unknown • Eg • Eg current organization integrity of superimpose systems for • Eg strong safety procedures

own standards of procedural compliance

ensuring procedures are feasible

socialization to ensure emerging

are inadequate

problems are known about

The study involved an analysis both of how failure had occurred in the past and how reliability or safety were being accomplished in the present. The analysis of failure involved a survey of offshore accident and incident reports; the analysis of accomplishment involved a programme of interviews of HSE inspectors and staff in operating companies. Three of the operating companies were, in one sense or another, new entrants, and two were established firms. In the remainder of the report there is a short review of the relevant literature, a description of the methods used in the study, an account of the findings, and a discussion of what we can infer, and what implications this has. The aim is to provide guidance to HSE, in particular, on how to scrutinize the way offshore operations are organized and managed.

3

2 BACKGROUND

The purpose of this section is to review the relevant literature, very briefly. The literature that most obviously concerns the way in which organizations attain very high levels of safety is that on high reliability organizations (or HROs). This literature points to a number of ways in which social organization solves the problem of making inherently hazardous systems acceptably reliable. It refers to redundancy and slack of various kinds (for example Roberts, 1990; Rochlin et al, 1987; Schulman 1993). It places considerable stress on learning from simulated rather than concrete experience (Weick, 1987), on the continuous search for improvement (La Porte, 1996), and on the avoidance of blame (La Porte, 1996; Grabowski and Roberts, 1997). It refers to notions of ‘heedful inter-relating’ (Weick and Roberts, 1993), ‘collective mindfulness’, (Weick et al, 1999) and ‘extraordinarily dense’ patterns of cooperative behavior (La Porte, 1996). And it draws on the idea of cultures of reliability (Weick, 1987) and flexible, expert-centred authority structures (Roberts et al, 1994; La Porte and Consolini, 1991; La Porte, 1996; Bigley and Roberts, 2001).

There is also a recurring theme of strength in adversity. What gets an organization from having merely ordinary levels of reliability to high reliability is, counter-intuitively, an environment that is particularly testing. Or it is the apparently counter-productive and self-confounding behavior of the organization itself. So, for example, Weick (1987) points out that reliability tends to increase when performance pressures are high, rather than low, as can be seen by the fall in error rates when air traffic control centers are handling heavy workloads. It turns out that it is in conditions of heavy, rather than light, load that air traffic controllers sweep the entire radar screen. Rochlin et al (1987) essentially say that the instability and turbulence produced by regular crew turnover and rotation on naval vessels is a source of, not impediment to, reliability. The continual retraining that this requires seems to avoid the loss of vigilance that Rochlin et al associate with more stable ‘civilian’ organizations. It also leads to a regular scrutiny of operating procedures that makes them more robust. And the movement of people about the naval organization rapidly diffuses lessons learned from practice. Early ideas about HROs seemed to contradict the notion of strength in adversity, referring for instance to the ‘buffering’ of environmental surprises and protecting the stability of a technical core (La Porte and Consolini, 1991). But subsequent work emphasized accepting and dealing with fluctuations instead of trying to remove them, seeking resilience rather than invariance, and tolerating and even protecting organizational ambiguities in order to cope with unforeseen events (Schulman, 1993; Roe et al, 2005).

This idea of strength through adversity seems explicable when we look at the quality of collective mindfulness that Weick et al (1999) particularly stress. Adversity produces reliability because it provokes a compensating, or even over-compensating reaction, provided there is mindfulness of this adversity. This notion of reflecting on what makes a setting adverse is particularly striking when the adversity is of your own making – which is seen most clearly in Rochlin et al’s (1987) examples of what the US navy does to make life difficult for itself, yet seems to profit from.

The idea of being mindful also reflects what Weick wrote earlier (Weick, 1979): ‘Most managers get into trouble because they forget to think in circles. Managerial problems persist because managers continue to believe that there are such things as unilateral causation, independent and dependent variables, origins, and terminations’. Reliability is not simply a function of a series of identifiable factors, whether internal to an organization or external: it is equally a function of how those factors are interpreted and responded to; and even a function of how the responses are responded to. Thus forgetting to think of organization in this circular

4

pattern seems likely to lead to the view that the problem of reliability is simply making the right choices of organizational structure or process – whereas a better view would be that reliability is obtained by continually acting and reflecting in order to act again. This takes us very close to the point we reached in the Introduction: the idea that what seemed to matter was making your choices work, rather than making the optimal choices in the first place. The particular point about strength from adversity is that continuing adverse conditions are a stimulus to take this more circular approach to achieving reliability.

The main challenge in achieving organizational reliability becomes the appreciation of this circularity when there are good reasons to avoid acknowledging it: the need to solve problems once and for all, and the need to demonstrate progress and improvement, for example. Attaining this appreciation, an appreciation that seems deeper than the more obvious reliance on particular safety-oriented practices and devices, is perhaps the best way of describing what we could mean by ‘rigour’. ‘Rigour’ was a term that interviewees, across all the participating organizations, occasionally used to say there was a right, appropriate or proper way of acting: one that suggested a deeper, more serious or more committed approach. For example it was occasionally used as a criterion for comparing organizations:

‘What was working at X like in comparison with Y? There is no comparison really… in respect of how we manage safety, if that’s what we’re looking at in particular, I think there was a lot less rigour at that point.’

It was used as a way of saying that specific measures, like procedures, only take you so far: ‘…it was one of those cases where operations thought that X were doing one thing and X thought they were doing something else… so yes you’ve got to have these procedures in place but at the end of the day you have to have the rigour of the… people’.

It was used as a way of indicating that merely ‘having’ safety management or (in this case) integrity management was not enough:

‘…a big issue was our integrity management… there was not a culture of rigorous integrity management’

It was used to indicate that an organization was dealing with issues of integrity and safety but that its efforts were in some way still incomplete:

‘…just to stay under control of an organisation of this scale you have got to go towards standardisation and a lot more rigour around that... But the rigour of, quality closure of actions, quality compliance of procedures, it’s just, it’s an area that we’re working on’’

It was used to indicate a certain depth of protection: ‘I think with a new operator, a smaller operator, just in general, that tolerance for risk can be greater, in which case not quite the same number of barriers get put in place… Putting all those barriers in place… to me implies rigour. We would apply a more rigorous approach to risk awareness and risk mitigation than perhaps small organizations.’

And it was used to say that ways of doing things were thorough, painstaking and properly completed:

‘…you know there’s quite a rigorous process by which we record what we’re going to do, risk assess what we’re going to do, get everyone to buy into what we’re going to do etc etc. Then close out when we’ve done it, document that you’ve done it and update any necessary bits and bobs paperwork wise.’

Our use of the term ‘rigour’ therefore broadly seemed to fit the way in which interviewees used it.

The reason for not simply reusing the term ‘mindfulness’ as found in Weick et al (1999) and Weick and Sutcliffe (2006) is that it is not just about being mindful, it is also about acting on this mindfulness. We can see this in Weick et al’s (1999) formulation of mindfulness – which is strongly cognitive – set beside Sagan’s more political thinking (1994). Organizations that are political do not see an automatic translation of mindfulness into action, as in fact Rijpma (1997)

5

points out. Learning starts out as cognition, but then has to become politics in order to have any effect. Therefore we have stressed not so much a mindful way of thinking as a rigorous way of acting – a way of acting that, in particular, involves attending to the consequences and entailments of whatever ways of organizing have been chosen by the actors in question. The ‘rigour’ label is the closest we could get to this idea. Rigour also has the advantage of not privileging any particular source of reliability-enhancing factors. It does not say that the source has to be culture, or psychology, for example, because in principle either could be a source of rigorous notions of acting, as could rule systems, or physical devices.

This is consistent with the notion, explained in the Introduction, that what matters in the achievement of reliability is less the choice of ways of organizing, and more the attention to and (over)compensation of the consequences and entailments of this choice. This seems to fly in the face of traditional thinking that stresses specific means of attaining reliability, like redundancy. But the extent to which redundancy really confers reliability is disputed anyway (for example Sagan, 2004). There are some kinds of redundancy, in some situations, that seem to be worse than useless: for example the social redundancy in which person A is meant to be checking the work of person B, but where both fail to do any checking knowing that the other will be doing it. A better statement about redundancy would be to say that reliability comes from either 1) having high redundancy and coping with the consequences or 2) having little redundancy and coping with the consequences of that. What matters is acting on the consequences of having more redundancy or less redundancy, just as much as the choice of how much redundancy to have.

6

3 METHODS

3.1 RESEARCH DESIGN

The were two main parts to the method: the first to analyse what the nature of failure said about rigour, when it was absent; the second to analyse what the nature of success (the avoidance of accidents, so far) said about rigour when it was present. Data for the first was provided by reports of offshore accidents; data about the second was provided by a range of interviews. This data was not used as objective evidence of what made offshore operations safe or unsafe, but as evidence of organizations either failing to, or managing to, be rigorous: failing or managing to deal with the by-products of their ways of working. These particularly concerned ways of working that were meant to be safe. But we have not tried to infer any simple relationships of cause and effect between being rigorous and being safe. For example, in one interview, someone claimed that building safety incentives into outsourcing contracts was important to avoid such contracts rewarding apparently productive but unsafe behaviour. This was evidence of a kind of rigour – recognizing that a consequence of relying on contractors’ common sense to keep them safe could be defeated by contracts that rewarded productivity, and changing the contracts so that they also rewarded being safe. But we cannot assume that any organization in any situation doing the same thing, in some mechanistic way, will make it safe.

The basic approach was to find as many examples of this kind as we could in the data, to group them into general categories, and then to ask how they were related to each other.

3.2 ACCIDENT REPORTS

The accident analysis was the smaller of the two parts of the work. The findings contribute to the final conclusions, but the exercise also provided important background for the interviews – notably by helping the interviewers understand some of the context in which interviewees were talking.

It involved two datasets: 1) a set of 40 incident reports published by the StepChange organization, which are mostly of minor incidents on offshore installations in UK waters, analysed informally by local individuals, and 2) a set of 34 MMS (Minerals Management Service) investigatory reports on incidents in the Gulf of Mexico, which are much more extensive accounts of more formally investigated cases. The StepChange reports are typically a page or so of narrative, whereas the MMS reports are typically 40 pages of narrative with diagrams and photographs. There are limitations in both datasets, and in the whole process of analyzing such reports. They may give a misleading view in hindsight of what was really knowable at the time, and they are the interpretations of particular individuals. As public documents they are also very likely to be subjected to self-censorship. Nonetheless our aim is not to diagnose particular incidents definitively, but to find out how organizations practice, or fail to practice, rigour in the sense described earlier.

The procedure was to work through each report and look for causal or contributory factors that involved in some way 1) choosing a way of organizing and 2) failing to manage the consequences of this choice. Each factor of this kind was generalized upon as a kind of rigour. For example, in one case a permit-to-work system was not fully understood and as a result not properly used. This was inferred to be a case of ‘rigour as giving substance to a nominal system’. In other words, there was a system in name but, in the absence of an understanding

7

how to use it and an understanding of why to use it, it remained nominal or token and incapable of achieving what it was supposed to achieve.

An attempt was then made to produce general aspects of rigour from these specific deficits. For example, the idea of rigour as making a nominal system into something that was properly implemented was seen as an example of a general idea of ‘substantiveness’. In other words, one aspect of what we mean by rigour in an activity is that it is substantive, dealing with substance not mere form or appearance. This process of going from particular observations to general aspects of rigour was inductive rather than deductive – and involved stripping away aspects of the context in particular cases that seemed uninteresting. This is a subjective process, as a particular analyst makes his or her own judgment about what is interesting, and it assumes that there is no objectively correct way of categorizing some phenomenon. Also, in many cases, the same incident could be categorized in more than one way, so that sometimes several aspects of rigour were implicated in one case. The main reason for adopting such a method, despite its subjectivity, is that it suits the purpose of drawing as much as possible from the insights of those writing the reports, and at the same time organizing them in a way that fits the general idea of rigour as a deeper capacity for making activity safe.

3.3 OPERATOR AND INSPECTOR INTERVIEWS

The dataset here consisted of verbatim transcripts of unstructured interviews with 1) 15 offshore installation inspectors in HSE and 2) a range of staff (from technicians to production directors) in five offshore operating companies. Please see Table 1 for a list of the interviews in the five companies. We undertook not to disclose the identity of the companies or the interviewees. The aim was to interview people across a wide range of seniorities in each company, with a roughly even distribution between operations staff and health and safety staff, but we were limited by individuals’ availability during the period given over to fieldwork.

The interviewees in HSE were asked about their backgrounds, their duties as they saw them, and the particular operating companies with whom they were involved. They were asked about their experiences and observations of these companies in terms of their organizational and managerial qualities, and how these seemed to have been linked to safety.

The interviewees in operating companies were first asked to talk about their duties and their activities, and then their roles in safety – both formal and informal. They were asked about issues that had arisen in our discussions with inspectors about them, and about issues that had arisen in earlier interviews in the same company. For example, where there had been significant events during the change of ownership of an installation, it was important to get the perspective of different people on what practices had in fact been relevant at the time, and how these had contributed to or undermined safety.

The aim was not to achieve an accurate, factual account of specific events but to get interviewees’ observations, experiences and insights into how different practices were linked to safety – and in particular to identify different aspects of the ‘rigour’ we described earlier. If someone talked about some practice contributing to safety because it dealt with some organizational issue or problem we took it at face value as an aspect of rigour. This does not mean we simply accepted this as an accurate account of what happened in a particular situation. There was no attempt in the interviews to ask a single, common set of questions as it was important to be able to follow up on interesting accounts and explanations and gain both a deeper and more concrete understanding of what interviewees had inferred from their experience. Interviewees’ insights were gathered both when they were offered in an affirmatory

8

sense (saying a particular aspect of rigour was found in their organization) and in a negative sense (saying an aspect of rigour was missing).

Table 1 Interviews in operating companies

Nature of organization Interviewees

Medium-sized operator, relatively recent entrant to the UK sector

16, ranging in seniority from technician to director, of which 9 had health and safety posts specifically

Medium-sized operator, relatively recent entrant to the UK sector

15, ranging in seniority from operator to director, of which 4 had health and safety posts specifically

Medium-sized operator, relatively recent to the roles of ownership and duty holder-ship

11, ranging in seniority from engineer to offshore installation manager, of which 6 had health and safety posts specifically

Large operator, established in the UK sector over a long period

13, ranging in seniority from technician to head of sector, of which 5 had health and safety posts specifically

Large operator, established in the UK sector over a long period

11, ranging in seniority from technician to UK health and safety manager, of which 4 had health and safety posts specifically

The interview transcripts were analysed in a ‘grounded’ way: that is, without a preconceived theory, only the general principle of looking for aspects of rigour. An example was of how people described the function of the safety organization within their firm. Some, for example, said in a straightforward way that this should be subordinate to the operating organization; others, at the same, said that they recognized a danger was that the safety organization would lose its capacity to think and act independently, and talked about how to preserve this independence even when it was the operating organization that ultimately made decisions and held budgets. The second kind of response we took as being an example of rigour. It points to a deeper capacity than simply having a safety organization, and simply having a clear definition of its responsibilities, and it deals with a by-product of giving this organization a particular kind of official relationship with the operating organization.

As with the accident analysis, an attempt was made to find a way of grouping and classifying these qualities, and of then looking at their inter-relationships. The procedure was similar to established processes of grounded analysis (for example Glaser and Strauss 1967), although various elements – like sampling – were determined by what was feasible rather than what was theoretically desirable. The basic procedure of generating classifications of things, and looking at their similarities and differences, is also a common one (for example Schatzman and Strauss 1973; Strauss and Corbin, 1990). For the justification for such methods please see texts on qualitative research (for example Berg, 1989; Bryman and Burgess, 1994; Mason, 1996; Walker, 1985).

In some organizations, the same aspect would crop up in different interviewees’ accounts as being present and absent, but this was sometimes in the context of different installations, so we

9

did not try to make any inferences from such apparent discrepancies. Also, many of the absences were past rather than present: they were descriptions of some kind of rigour that had been absent in the past – that may well have come into existence in the present. This means that our data cannot be used to say that one organization is better than another because it somehow demonstrates more rigour.

Finally, it is important to reiterate that we did not try to assess whether interviewees were making factually correct assertions. We naturally noticed in the course of the interviews within a particular organization whether people made contradictory statements about whether particular practices existed or not. In one, for example, there was no consensus about whether the organization had a ‘just culture’. What was of more interest to us were interviewees’ insights into the consequences and by-products of such practices, whether they are approved of them or not, and whether they thought they existed or not.

10

4 ASPECTS OF RIGOUR

4.1 ASPECTS FROM THE ACCIDENT REPORTS

The main qualities that we inferred from the accident reports as being distinct aspects of rigour are shown in Table 2, together with brief explanations. These were our generalizations on what the report writers had somehow indicated were important aspects of organizing that would have contributed to safety or reliability, which we interpreted as being somehow additional to, or deeper than, a choice of how to organize.

Table 2 General aspects of rigour inferred from accident reports

Aspect of Explanation rigour

Being Being thoughtful, formal, penetrating and profound rather than shallow and intuitive analytical

Being Being a source of authority, expertise and direction, and being willing to exercise authoritative power

Being Being constrained in your ambitions and objectives, not extending capabilities too far bounded

Being Being concerned to involve people widely, to consult, to engage in joint decision collective making

Being Being willing to follow agreed norms and standards compliant

Being current Being up-to-date, being adapted to the existing environment, being aware of change from an historical norm or expectation

Being Being put into a concrete, specific form in contracts, agreements and so on that create embodied obligations

Being engaged Being actively a part of a larger system, and being connected with others working to achieve the same ends

Being Being a source of information and understanding for those who have dealings with the informative activity

Being planful Being systematic in making prior arrangements and plans

Being Being able to reflect on the limitations and consequences of the activity itself reflexive

Being Being supported by sufficient and appropriate resources, including aids and assistance resourced

Being Being aware of, and inquisitive about, potential problems, errors and differences of sceptical interpretation

Being serious Being sufficiently concerned, conscientious and energetic, not being casual, passive or superficial

Being situated Being tailored to specific circumstances and not just lazily inherited from a general procedure or practice

Being Being concerned with substance, action and deeper implications, not being merely substantive token or nominal

11

Aspect of Explanation rigour

Being Being clear and specific and leaving no problematic or unproductive doubt unambiguous

Being uniform Being similar or consistent in different places or on different occasions, without unconsidered variation

Many of these are pedestrian and offer little insight: for example the quality of being resourced, or being serious, or being bounded in your ambitions. They are qualities that most people would naturally look for in an organized activity. Others repeat themes found in the literature outlined in Chapter 3: for example, the idea of scepticism – of an organization that looks for signs of vulnerability or failure instead of making a default assumption that, in the absence of anything particularly obvious, all will be well. But some emphasise qualities that some of the literature tends to discount – like being ‘planful’. And, as we describe further in the next sub-section, some look contradictory.

Table 3 gives examples for each of the qualities in specific cases. The table shows the source of each example, our very brief outline of how the accident was diagnosed, and the rigour that the diagnosis seems to imply. It is important to emphasise that the same case was often a basis for inferring several qualities, so the aspect of rigour linked to a case in this table was not intended as a way of encapsulating the case as a whole. The most relevant aspect of the diagnosis to the aspect of rigour in question, in each example, has been italicized.

Table 3 Examples of the aspects of rigour found in accident reports

Quality of Shortfall in Case source Diagnosis in case activity rigour in case implying rigour

Being analytical

Being authoritat-ive

Failure of individual to carry out reasonable technical calculations

Failure to know of individual’s

MMS 2007-037 Ejected tubing and loss of well control

MMS 2004-046 Crushing by

Attempt to free stuck tubing led to parting and ejection of slips that struck an individual and led to loss of well control; failure by the deceased to calculate adequate safety factor when determining maximum pull force; deceased acted beyond his authority; ineffective managerial oversight at all levels; operator entirely reliant on consultants; operation should in any case have been shut down and regulator approval sought; neither of the operator’s supervisors shut down the job in spite of the safety violations and unsafe work practices – nor report these to their managers; the operations manager approved the activity with assumptions he failed to verify and was disengaged from day-to-day operation; he also failed to follow up an unmet request for details of the procedure; an office consultant was misinformed about the operation but failed to make any visit and failed to recognise potential conflict of interest with the deceased representing two firms

Person walked unobserved to crane side of pipe rack and attempt to stop load swinging led to fatal crushing; employee’s enthusiasm evidence on previous occasions

12


Being bounded

Being collective

Being compliant

Being current

lack of swinging and supervisory failed to act on this or his inexperience; qualifications, suspended supervisor was ignorant of his lack of formal training, failure to load allowed insubordination and failed to deal with individual address past following directly, contributing to command uncertainty; company transgressions, supervisor’s had no training schedule or policy; company failed to have failure to ignorance of documented directions for representative on site address him lack of directly formal

training

Absence of StepChange Tow wire snagged, came free, caused person to step back danger area as 973 and be caught in closing tow pins; tow pins did not have exclusion zone Tow pin audible alarm when operated; due to crew change

incident occurring at same time tow pin operator was distracted; revised set of procedures include only raising one tow pin a time, danger area around pins to ensure no crew members inside whilst pins operated; management of change due to increased hazards while crew changing

Failure to MMS 2007- Tubing supporting BOP stack assembly bent suddenly ensure that the 045 under the load causing the BOP to break free and fall job safety Tubing overboard. A CT technician was attached to the BOP analysis was fracture and Assembly by his safety line and was pulled overboard. attended by all BOP fall There were no engineering calculations, the temporary relevant staff work platform precluded attachment of safety lines, there

was a lack of detailed planning and no discussion of potential anomaly, the contractors were not involved in the planning who did not know the unusual nature of the set-up until reaching site, there was no JSA meeting or shift hand-off meeting, and no oversight of the contractor by the operator

Failure to MMS 2005- Barricade snagged because shackle installed pin-up and follow 078 shackle had no shims to centre it. Failure to follow corporate Snagged corporate safety guidelines requiring pre-checks and safety barricade spotter not leaving post during man-riding. Also, uncertain guidelines carried up command structure introduced a lack of organization and

and fell work direction, led to failure to perform job safety analysis, and allowed violation of guidelines. Possibly also unusual level of fatigue following long transport time and attenuated rest period

Mothballing StepChange During attempts to open a valve on a mothballed test of item 969 header, a plug shot out of the valve body; personnel avoided Failure to evacuated; then assumed that test header isolation valve upgrade follow safe closed and decision made to repressurise line; this resulted

systems of in a second larger hydrocarbon release from bleed port as work (PTW) personnel fitting a replacement plug. Review conducted to leads to bring valve back into service inadequate and did not hydrocarbon identify need to replace bleed plug; previous incident release involving corrosion of bleed plug prompted replacement of

several plugs on operating valves but as this valve was mothballed at the time the plug was not replaced; following initial release, PTW not reviewed to ensure new valve plug fitted, gas trapped in system isolated and

13


Being embodied

Absence of contractual

StepChange 966

requirement to ship equipment in safe state

Unsecured coil

Being engaged

Failure to oversee, communicate

MMS 2004-075 Loss of well

prioritise and assign work

control from injection fitting corrosion and leak

Being informative

Absence of alarm

StepChange 973

indicating equipment operating

Tow pin incident

Being planful

Failure to plan unusually-configured operation in detail in

MMS 2007-045 Tubing fracture and BOP fall

collaboration with contractor conducting it

Being reflexive

Failure to recognise hazards of

StepChange 974 Gas release

hazard after shut-in response for cyclone

vented, new or changed hazards identified, adequate controls in place, clearly defined and communicated process steps; lack of communication between control room and personnel in field such that people not made aware of what actions taken or about to be taken

Cladding cut from spool of coiled tubing, no chain securing coil end to drum, coil sprung up and became loose on drum striking individual; no safety check of critical equipment at arrival on platform; no contractual requirement for coil ends to be chained to reel; lack of recognition of this as non-routine job

Leak through severely corroded and thus weakened plastic injection fitting; corrosion from extended service in harsh splash zone, coupled with absence of historic maintenance. Management failure to support and oversee work meant failure to inspect and maintain wellhead components, to communicate regularly with on-site staff, to give written instruction to contractors, to perform thorough job safety analysis, to have specific written tasks and assignments

Tow wire snagged, came free, caused person to step back and be caught in closing tow pins; tow pins did not have audible alarm when operated; due to crew change occurring at same time tow pin operator was distracted; revised set of procedures include only raising one tow pin a time, danger area around pins to ensure no crew members inside whilst pins operated; management of change due to increased hazards while crew changing

Tubing supporting BOP stack assembly bent suddenly under the load causing the BOP to break free and fall overboard. A CT technician was attached to the BOP Assembly by his safety line and was pulled overboard. There were no engineering calculations, the temporary work platform precluded attachment of safety lines, there was a lack of detailed planning and no discussion of potential anomaly, the contractors were not involved in the planning who did not know the unusual nature of the set-up until reaching site, there was no JSA meeting or shift hand-off meeting, and no oversight of the contractor by the operator

Gas release from corroded section of riser above water-line and not accessible to internal or external inspection; no inspection hatches on the caisson, and diameter of this section of gas riser too small to allow intelligent pigging. Should highlight any latent defects in inspection and maintenance regimes in inspection reports; should ensure equipment designed to provide adequate access for inspection & maintenance; should recognise that when responding to a potential gas release the response to the initiating event can also contribute to harm to people.

14


Being resourced

Being sceptical

Being serious

Being situated

Being substantive

Failure to facilitate manual handling operation

Failure to monitor redundant pressure gauge

Failure to meet defined operating constraints of tool

Failure to tailor setting to specific well

PTW system given nominal rather than substantive attention

StepChange 971 Pinched finger changing crane block falls

MMS 2005-007 Loss of well control after pressure gauge failure and test waiver

StepChange 963 Shallow cutting pipe casing using a Radial Cutting Torch resulted in uncontrolled release of energy at surface

MMS 2004-010 Loss of well control following loss of drill fluids to highly permeable layer

StepChange 981 Confined space working

Need to clearly highlight potential pinch points during the risk assessment and toolbox talks and ensure mitigating factors are in place; carry out a thorough review of different options in carrying out this task; remove manual handling and pinch point hazard; construct frame to hold the block upright during the change out operation

Loss of control after causing burst: well gauges on driller’s console failed to measure and record pressure accurately and, partly because of false pressure readings, appropriate actions to mitigate rising pressures not initiated; redundant gauge not checked; and casing failed catastrophically at pressures below design because of undetected wear; metal recovery from ditch magnets reported irregularly and apparently not heeded; required test of casing that may have revealed wear was postponed 11 days after waiver from the regulations requiring a 30-day test was granted; information on metal recovery not included in data used to request waiver

Attempt to cut casing using Radial Cutting Torch failed, resulting in release of energy; caused by fluid level depth being insufficient directly below RCT, resulting in tool being forced up well when detonated; risk assessment and toolbox talk had identified possibility of a discharge at surface and all appropriate measures in place; defined operating parameters of using such a tool state that there should be a minimum of 30 metres dry column below tool

Loss of drilling fluids to highly permeable, geologically anomalous, thick sand deposit encountered while drilling; sand zone not identified in 4 wells previously drilled from platform, and encountered less than 100 ft from nearest location of those wells; failure or inability to forecast presence of thick anomalous sand through use of sparker and shallow gas hazard surveys; lack of forewarning of odd morphology contributed to failure to plan for difficult circulation problems; generic setting depth of drive-pipe prevented emergency isolation of thief zone, possibly set by construction department at generic depth, rather than at a depth tailored to actual well-specific requirements determined by drilling operations

Onshore pumping operation went through wrong operating sequence allowing backflood of oil into engine room. PTW system was not fully understood and not properly used – needs to be explicit, specific, checked, countersigned

15

Quality of activity implying rigour

Shortfall in rigour in case

Case source Diagnosis in case

Being unambig-uous

Cues & instructions provided by task analysis lacked specificity

MMS 2004-004 Individual leaned over walkway to wrap light fixture that

Contractor employee’s decision to ignore supervisor’s instructions to use PPE; given employee’s experience, training, and performance appraisal, as well as the proximity of his PPE to the site from which he fell, this decision inexplicable. Contributing cause was informality of Job Safety Analysis with only reference to PPE as ‘P.P.E. at all times.’

gave way

Being uniform

Absence of standard practice requiring updated surveys for new wells being drilled from previously drilled

MMS 2006-021 Loss of well control from influx of gas from unidentified pressurized zone

Loss of control from influx of gas from unidentified pressurised zone. This may have been migration of gas from one of the previously drilled reservoirs into the originally under-pressured zone; or it may have been a localized pocket of gas that would not have been seen in any of the previous seismic information. A possible contributing cause is the absence of both regulatory requirements and standard industry practice requiring updated shallow hazards surveys for new wells being drilled from previously drilled locations

locations

The implications of this analysis, especially the inter-relationships among the qualities listed in Table 2, are dealt with in the Discussion.

There are several limitations of this analysis: 1. The observations found in accident reports are bound to be partial because they involve the

diagnosis of specific events rather than saying in some general way how failure occurs. Thus, for example, a specific diagnosis might see a central problem with procedural compliance as an insufficient understanding among individuals about what a procedure was for. But this does not necessarily give us an insight into all the other issues arising around procedures, such as the insufficient understanding among procedure writers of the conditions in which they have to be applied.

2. Many of the incidents we analysed involved small scale issues of personal safety that might be seen as being unrelated to the vulnerability to large-scale catastrophic failure.

3. The reports may be idiosyncratic interpretations of events, on the one hand, or (especially in the case of the larger and more formally investigated accidents) say only what was consensual among those contributing to the investigation.

4. Given the complexity and subtlety of what could be meant by the ‘deeper’ capacities of organization to maintain safety, and the complexity of the setting, the sample of 74 accident reports is a small one and it is unlikely that the list of qualities shown in Table 2 is comprehensive.

It is also important to say that the labels we have used are to some extent arbitrary: different analysts would see slightly different qualities and capacities and give them different labels.

16

4.2 ASPECTS FROM THE INTERVIEWS

A similar set of distinct aspects of rigour was tabulated on the basis of the interviews, and these are shown in Tables 4, 5 and 6. Because, during interviews, it is possible to ask interviewees just why they thought particular qualities important we can also make more inferences about just what it is about organized activity that these aspects of rigour deal with. Table 5 therefore has a column summarizing what each aspect of rigour achieves – and in each case this is framed in terms of the problems that organizations cause for themselves in the ways they work and the ways they respond to threats to safety in their environments.

Table 4 Aspects of rigour found in interviews

Aspect of rigour Explanation

Being active Being predictive and pro-active or self-actualised, prioritising problems for oneself, taking action before others prompt it

Being analytical Being systematic, methodical and grounded in analysis rather than intuition or mere convenience

Being authoritative Being exercised with authority, definitively and legitimately

Being Being constrained, realistic or limited in scope or ambition or action circumscribed

Being Being based on the expectation of needing dense patterns of inter-communication communicative and mutual information (similar to observations in the literature on ‘extraordinarily

dense’ patterns of cooperative behavior: La Porte, 1996)

Being completed Being carried through or logically completed from insight through to action and monitoring

Being current Being current, up-to-date, fully refined or modified

Being Being done without intermediaries by direct interaction of (for example) individuals disintermediated and managers

Being dutiful Being based on a notion of duty rather than an analysis of costs and benefits

Being engaged Being closely involved, engaged, interested and open, whether between different levels of authority, links in a supply chain, or divisions of an organization, in recognition that safety is a joint accomplishment

Being essentialistic Being focused on the most important aspects or foundational elements of a situation

Being generalised Being uniform, consistent or general in approach rather than allowing uncontrolled local variation or completely idiosyncratic diagnosis

Being internalised Being done within a process or organization rather than being delegated or subcontracted elsewhere

Being legitimising Being concerned with legitimising and regularly relegitimising desirable activity

Being moderate Being measured or partial in the way of acting, rather than extreme or total

Being multicentred Being carried out with multiple centres of authority and responsibility, rather than concentration in a single command structure

Being orderly Being concerned with order, tidiness, the absence of clutter and confusion

Being painstaking Being done with attention to detail or minor aspects or deficiencies

Being political Being based on an understanding of the power of relevant groups and the need to recruit powerful groups in favour of safety

Being reflexive Being able to reason about and deal with limitations of your own process

17

Aspect of rigour Explanation

Being resolute

Being resourced

Being respectful

Being situated

Being socialised

Being solicitous

Being stabilising

Being synthesised

Being systematised

Being unequivocal

Being resolved to settle an issue, being prepared to grasp nettles, being willing to be embarrassed and generally being willing to suffer immediate cost to deal with a basic problem

Being done with sufficient support, resource or funding to both meet an objective logically and to recruit others into supporting your efforts

Being heedful of expertise rather than simply subordinating it to managerial authority (another theme found in the high reliability organizations literature)

Being adapted to the situation, not generic or rule-bound

Being aware of, and using, systems of social obligation to achieve desirable ends

Being done in a way that seeks opinion, welcomes it without challenge and is sceptical of one’s own knowledgability

Being oriented towards the stability or constancy needed to act effectively

Being integrated, pulled together or global in understanding of system-level phenomena like cumulative degradation and the deterioration of multiple defences

Being based on systems, and plans: being ordered and integrated

Being committed to a specific, explicit model or ideal or policy

Table 5 What the aspects of rigour found in interviews achieve

Aspect of rigour What this achieves

Being active Overcoming tendencies to allow the environment to structure and prioritise your reactions, and generally to be passive and reactive

Being analytical Overcoming tendencies to act rapidly and avoid effortful, time consuming analysis

Being authoritative Overcoming goal and leadership uncertainties arising from complex activity

Being Overcoming the tendency to act with enthusiasm and speed that can come unstuck if circumscribed not accompanied by a clear sense of what must be accomplished

Being Overcoming the problems of division of labour, the expectation that a logical communicative division of labour avoids the need for communication, and narrow rules of thumb

about a ‘need to know’

Being completed Overcoming the tendency to act in token ways, to deny resources to monitoring and follow-up, and to allow maintenance backlogs to develop without apparent limit

Being current Overcoming tendencies in complex systems for local elements to become out of date as they fail to receive refreshed information, or fail to act on it, or act on informal and incorrect understandings

Being Overcoming the tendency to create intermediaries for representing or conveying a disintermediated group’s opinion in order to avoid intrusive contacts

Being dutiful Overcoming the tendency to resolve issues on the balance of cost and benefit and the balance of competing interests, and therefore (for example) dismiss weak signals of potential problems

Being engaged Overcoming the divisive effects of differing goals, differing origins, competition for power or resources, or historical distrust

Being essentialistic Overcoming over-elaboration and confusion arising from operating complex systems with multiple stakeholders; and overcoming the temptations of doing what is straightforward or superficial rather than what most matters because of

18


organizational pressures on resources and organizational rewarding of token conformance

Being generalised Overcoming the tendency for local actors to extemporise, diagnose problems without thought to their systemic nature, and base their actions on purely local logics that might compromise global qualities like safety (as in the literature: for example Rasmussen, 1990; Snook, 2000)

Being internalised Overcoming the loss of influence and capacity from externalising important expertise and the tendency to ‘outsource’

Being legitimising Overcoming the influence of informal and cultural norms where these contradict formal controls (see in particular the idea of normalised deviance: Vaughan, 1996)

Being moderate Overcoming the self-limiting qualities of remedies easily carried to excess (see the literature citing social loafing for example: Sagan, 1993) that can produce cynicism or even ridicule; overcoming tendencies to be doctrinaire or dogmatic about the need for some protective practice, and the tendency to over-sell a practice (and therefore over-do its application) in order to overcome resistance

Being multicentred Overcoming the imperative to achieve unambiguous, univocal authority by putting protective functions in the ‘line’

Being orderly Overcoming tendencies towards ‘entropy’ in organization. (The literature refers to the need for maintenance activity to do this – for example Grabowski and Roberts, 1997; but it also refers to the opposite ‘negentropic’ tendency – for example Pidgeon and O’Leary, 2000)

Being painstaking Overcoming the tendency of normal prioritisation systems and imperatives to dismiss the physical and symbolic potential in apparently minor defects (see the literature on weak signals, eg Weick and Sutcliffe, 2001)

Being political Overcoming tendencies to believe that the case for safety speaks for itself, that a logical need is enough to mobilise action and resources

Being reflexive Overcoming the traps of being limited by your own assumptions and convictions that arises from a commitment to particular views of the world; (see the literature on ‘mindfulness’)

Being resolute Overcoming the tendency to avoid the embarrassment of acknowledging fundamental problems, to incur short term costs and to defer difficult issues for later regimes

Being resourced Overcoming the tendencies to reduce costs and postpone spending needed to maintain systems under commercial pressure

Being respectful Overcoming the demotion of expertise that follows the dominance of managerial staff (see the literature on deferring to expertise, eg La Porte and Consolini, 1991)

Being situated Overcoming over-generalised approaches to dealing with situations that arises from attempts at consistency and uniformity

Being socialised Overcoming the tendency to expect that logically obvious actions are bound to be taken in a social organization, and overcoming the tendency to focus merely on the effects of action on the current problem (rather than also consider future relationships)

Being solicitous Overcoming the tendency to self-referentiality, conceit and defensiveness from a long, successful history

Being stabilising Overcoming not just environmental tendencies like an itinerant workforce but the exacerbating consequences of your own policies like not optimising working conditions

19


Being synthesised Overcoming tendencies to fragment knowledge of deficiency and defect along divisional or departmental lines

Being systematised Overcoming the tendency for local actors to extemporise and base their actions on purely local logics that might compromise global qualities like safety (as in the literature: for example Rasmussen, 1990; Snook, 2000)

Being unequivocal Overcoming tendencies to have ambiguous or equivocal policies or models in order to deal either with the problem that all models have by-products or the problem of getting consensus among staff

Table 6 gives examples of fragments of the interview transcripts that were categorized under these aspects of rigour. Sometimes the fragments refer to the presence of such a quality, sometimes the absence.

Table 6 Examples of the aspects of rigour found in interviews

Aspect of Specific Interview fragment rigour description

Being active

Being analytical

Being authorit-ative

Being circum-scribed

Being commun-icative

Rigour as actively seeking your own standards, not passively waiting for them to be imposed by eg clients

Rigour as thoughtfulness about, rather than avoidance of, economising

Rigour as exerting personal authority rather than relying solely on systems

Rigour as restraining ambition which might produce merely token achievement

Rigour as communicating back to those reporting failures and

‘it’s been very, very difficult to have the senior management influence….in terms of [X] senior management to influence the way they manage their crews, they’ve not been at all forthcoming they have done nothing of their own volition, effectively we have imposed particular standards on the rig and made them adhere to them by measuring them on a fortnightly basis…because we put a safety improvement plan in place in April last year for the rig because the [X] management wouldn’t do it’

‘[X] was wanting to push the envelope more, to try things, to cut the well design down… and there’s nothing wrong with that but it should be done in a structured way and it should be done with a proper assessment and that one example was that they were trying to push things through without I think really fully thinking stuff out’

‘… had [an] MD with strong views on bureaucracy – very simple management systems, although did have risk assessments which were written and worked to – but very dominated by the boss – forceful, extravert, wouldn’t tolerate mucking about, meant it about safety – and his workers knew they could refuse a customer request on site if they thought something unsafe – kept things stripped down, very experienced workforce’

‘we’ve got an HSE improvement plan for this year which is just staggering in terms of what we’re actually trying to achieve and I just think ….you might get there but it won’t be by delivering a quality product, it will be by putting something in place that kind of ticks a box’

‘I think probably [X] as a whole aren’t very good as a whole at feeding back what comes of your queries so at a safety meeting you might raise something (e.g. a handrail) and there’s no kind of trail for it until the next time it’s raised, and somebody will say oh yes we looked at that I think and this is the answer, and so again that’s an ownership thing if you ask a

20

Aspect of rigour

Specific description

Interview fragment

defects question and somebody says right I will find the answer for you they should really personally, they should feeding that back, downwards, …it should be a two way flow of information’

Being Rigour as ‘if we were looking at the permits they would set themselves a target for completed carrying auditing permits say 10 per cent of all permits issued and when we went out

through audit there they had more than met that target, not only do they carry out audits activity to but they would identify the findings from those audits and they would learn diagnosis and lessons from them and implement those lessons… I mean a lot of people do completed what we …what I would call a compliance audit you know they just check actions things are in place and if they are not in place then they will make sure that

they put them in place but I think [X] go one more step than that and they not only find out that things are not in place but they will identify why they are not there and therefore they would look at their procedures and amend their procedures to ensure that they’re changed so its not just compliance and making sure things are right it’s also finding out why they went wrong in the first place’

Being Rigour as ‘…and if you can’t find it there, then there’s another system which is more current maintaining of an electronic filing system you can go in through the back door if you

currency and like to try and find it, this is very, very common you find something which removing you think then is the up-to-date document that you’ve not got through the obsolete official channel and you start using it and it’s not its been superseded, it’s procedures been removed but for some reason it’s been left within [the system]’

Being Rigour as ‘I said well why do you think you know there was a couple of vacancies, disinter- avoiding why do you think you can’t get them, and he said well honestly I don’t mediated intermediation think people think they need them…and having pursued that a little bit that

of safety seemed to be quite genuine …it seemed to be reflected in people we spoke representatives to about, you know, what would happen in certain circumstances, well we

just contact the supervisor, it’s almost sorted, any issues sorted by the line without …we don’t have to go to a…you know complaint or through a third party….so you know morale was high that was the sort of attitude of the installation’

Being Rigour as ‘the corrosion was picked [up] by HSE… the process equipment’s fine and dutiful acting out of made in modern materials but not the structure… the problem is that when

duty rather HSE give guidance they can always say ‘we will do that soon’… and the than cost mindset in HSE can be to wait until there’s a problem as the law doesn’t benefit analysis allow us to intervene until there is… In [region A] it’s a local regulator and which justifies instead of doing cost benefit analysis they just decide it’s a duty’ passivity

Being Rigour as ‘they listened and that’s healthy and you want to see that…never mind if its engaged engagement confrontation as long as both parties realise it’s a negotiation process and it

among groups took a little while for the workforce representatives there to understand that even when it you went in there fought your corner and got as much as you can get and involves that was a very, very healthy working relationship there….they had a confrontation professional regard for each other and that’s the kind of thing that you’re

looking for, you know it’s a healthy live dialogue that you’re seeing and that the workforce is integrated as the management can allow them to be’

Being Rigour as ‘there were three businesses on the site and depending on which way essentialist steady, un- people went when they got through the fence they’d behave one way or the -ic ostentatious other – refinery, pipeline business, chemicals business.. refinery was the

maintenance of biggest and series of incidents and accidents all associated with this – much capability more go-go-go, action oriented management – boring maintenance got no

attention – seagull managers from other parts of the business flew in, did a

21

Aspect of rigour


Interview fragment

project and flew off again – whereas the chemical business was a lot more patient, concentrated on eg upgrading the paint on their vessels – doing the boring things’

Being Rigour as ‘we split one of the OIM’s [ ] to do one week on [X] and one week on [Y]. generalised trying to be We found we learnt a lot through that process in terms of how things are

consistent in being applied on one platform versus another and there was some subtle approach at differences in terms of isolations and stuff but… again we’ve worked hard different to ensure that there is consistency and we also have our HSE and SR group locations that are independent to operations and have a single point in common in

terms of [Z] [HSE Manager]. Because any HSE policies would come through [Z] he would ensure they would get distributed and… implemented in the same way on board both platforms, and we also bring our [safety staff] together on a regular basis to ensure things are being done the same on the instructions’

Being Rigour as ‘[X] had got to the point of outsourcing everything but the OIM, but internal- retaining some realised they’d gone too far and were now recruiting supervisors to be ised direct employed by [X], although this was complicated by expansion and the lack

workforce to of engineers… it’s back to the company having its own engineers who are ensure able to be authoritative… the problem is ownership – if you outsource a commitment foreman or supervisor do they really own the problem?’

Being Rigour as ‘and their commitment to safety – in terms of, if anything, if people had got legitimis- legitimising any concerns then they can raise them, stop the job etc… again if you ask ing and re- anybody at any level and said look if you were concerned about this did

legitimising the you feel free to you know stop the job or raise concerns, yeh no problem stopping of …so that sort of culture… it’s interesting that [Y] seem to have re-unsafe invigorated the Stop system’ activities

Being Rigour as ‘…but they don’t take it to the extremes that the likes of [X], the last moderate avoiding platform I was on [X] took the bread knife out the galley so you that

precautions couldn’t cut a bread roll, they didnae trust you to cut a bread roll without that might be cutting through your hands I mean they would sign a permit for you to seen as work with 11,000 volts but they wouldnae trust you to cut a bread roll, so pedantic or they went to extremes you know and so far [X] hasn’t done that so for that trivial point of view I would say that they’re a bit more realistic about the safety

side’

Being Rigour as ‘yes it’s a design to get it close to the operation but at the same time very multi- maintaining conscious of the need for independence, so as well as being direct report to centred some me, [X] has dotted reporting relationship to [Y] who is the managing

independence director, he also has a dotted reporting relationship to corporate, [Z] in safety authority particular and there are a number of devices that are available to anybody in

[X] to raise health, safety and environmental issues that can be internal, through our integrity hotline, or it can be external through the likes of HSE so we feel there’s enough independence around that it doesn’t create conflict of interest having it closer to the operations groups than further away’

Being Rigour as ‘big issue we’ve got at the moment is the management system the UK orderly orderly and management system …it’s business, it’s safety and its environment and

controlled recently discovered there is holes in that it’s not been applied consistently, dissemination documents that people are using they think are up to date because they’ve of got them through a back route, is not necessarily the document that … they documentation should be using…so there’s actually a project kicked off to take a look at

that’

22


Being painstak-ing

Being political

Being reflexive

Being relentless

Being resolute

Rigour as sensitivity to significance of small violations

Rigour as recognizing and exploiting the authority of particular groups to secure resources

Rigour as being honest with oneself about the motives for taking short cuts

Rigour as continually bringing attention back to protection

Rigour as seeing past the temptations of short-term self-presentation and self-promotion

‘I know this sounds a bit of a cliché but they do have safety first at all their meetings, that’s a key part of being at [X] – safety first on the agenda, all our morning calls for instance start with safety, we talked about the minor incidents this morning, we talked about a lighter in the washing machine and we talked about it for five minutes because it’s really important – somebody had taken a cigarette lighter offshore with them which is a big no no, and also it was found in the washing machine so there’s two things there, one, we’ve got foreign objects in the washing machine which can cause a lot of trouble and if the washing machine goes down for instance you may have a downed man. I know it sounds crazy but… and we had the issue of the cigarette lighter being taken offshore and we’ve got a lot of third parties out on the rig at the moment so we’re having that long discussion this morning, we only have half an hour for each rig but 5 minutes of that was consumed by this discussion of a lighter’

‘for example the people running [X] needed a resource from the central [Y] office and they couldn’t get it until we gave them an Improvement Notice and then they got it straight it away…it was sort of these people had responsibility without authority …they had responsibility for keeping the maintenance programme going and getting it going but they didn’t have the authority to get priority over the resources within [Y], and that’s the problem with a company that grows and fragments itself, and then we have to come along and enforce and they say oh yes we’re getting someone on Monday….we’ve been trying for 6 months and we haven’t been able to get [them], thank you very much for helping us, and that’s quite often the case …the guys who are at the sort of doing level are tearing their hair out because they know what’s wrong and they know what they need to fix it but can’t get what they need …and then we’ll come along and we’ll say is there any area we can assist you?’

‘Some people will take short cuts through lack of competence or its easier to do it this way, it’s a short cut for them to save time, a number of reasons behind it but again its all about looking at yourself, being honest with yourself, and being honest with the people around you.’

‘but certainly the [X] one needs a little bit of re-energising, re-crafting, remind people what it is all about, it doesn’t matter what tool you use in safety, in my opinion it will inevitably slide off… and you have to constantly re-energise and it will come off, constantly re-energise and it will come off.’

‘secondary to that you have the support of the senior management from the top down, safety first is the message from these people and they genuinely mean it, you know they have management visits offshore, at weekends and things which we don’t really see but their commitment to it is I would say first rate, particularly from [person X] who is the ops director for Aberdeen and I’ve seen it in [location A] as well, and [location B] as well… when I’ve worked on those locations as well with [X], so it’s not something in the UK, the message is the same the whole way across. A recent fatality we had on one of the drilling rigs in [location C], we had no response from the drilling company and [our company] undertook an enormous investigation and were hugely self-critical taking into account that they recruited this rig… they’re not scared to look in, they’re not scared to be self critical and look how we can be better, I think that’s very important’

23


Being resourced

Being respectful

Being situated

Being socialised

Being solicitous

Being stabilising

Being synthesis-ed

Rigour as making organizational arrangements that ensure adequate funding

Rigour as giving authority to technical expertise

Rigour as allowing adaptation of procedures in specific situations for good reasons

Rigour as concentrating on maintaining social relations

Rigour as seeking independent opinion

Rigour as stabilising the workforce to maintain competence

Rigour as assembling an overall

‘there wasn’t an awful lot of autonomy within [X’s] hands but that’s changed I believe in the last couple of years and [X] have much greater authority to actually spend the money that’s required and I think there is a better flow of finances from [Y] and [Z] who are actually investing quite a lot through [X] and the installations … the [Y] and [Z] do sit in on quite a lot of the meetings and keep a close eye on what’s going on and they do hold the purse strings at the end of the day so while they have got a lot more leeway to spend money and direct to where they think and I think probably the channels for getting money are a bit easier there is obviously a lot of scrutiny because it’s a lot of money’

‘the demise of the engineering function… some of the new companies eg [X] are much stronger in the engineering function – eg if a new pump was required… in [Y] the first thing they’d say is ‘write a business case’ whereas in [X] it would be ‘send me the pump’ … drilling companies are more engineering driven and so the demise of engineering authority much less…’

‘sometimes it was written quite appropriate for one situation but for the other situation it didn’t quite work. And now it’s recreated, as long you do the shalls then the shoulds you can [adapt] to a situation. And I think that’s going to be a significant step forward in making simpler, easier, make clear to people what they have to and the guidance is there for how to do it... It’s a bit like the HSE guidance, you have to have a good reason for not doing it. You can’t just say I don’t want to do that, you have to have a good reason for not doing it and have something equivalent and appropriate in place. But yes, which is sometimes you can’t write procedures that cover every possible scenario or situation. ‘

‘the work force needs to feel comfortable with us and know that we’re there to help, not to dictate and… big stick……back to this communication thing, they need to know if they are unsure of anything they can come straight to us and say… but people won’t ask you that question because of this, oh well you should have known in the first place… so our commitment to safety should just be very understanding and communicating and just don’t get angry with them’

‘in the past we have been using the HSE as a sound board if you like, so when we do a risk assessment as part of our management of change procedures we need some point of contact with HSE, and they provide an independent review so they are not purely a… police if you like, they’re not purely to police but they are a genuine independent body which helps us to make sure that what we have in place is safe’

‘we’ve been quite stable since I would say the last 18 month or so and we’ve had very little turnover on [installation X] and [installation Y] – probably 2%, something like that I would probably say that 5%, 6% was a reasonably healthy turnover because it’s good if you can move people around a bit ….but as you say if you get too many, we had at one point nearly 50% of our production operating team we lost in a very short time, so it is difficult to get experienced people in who can become competent, to do what you want them to do in a relatively short period of time… and I think one of the ways we stabilised that was to have one of the best packages for contractors in the UK sector’

‘carried out an inspection on [X] and we found some fairly serious problems which they had totally missed, they were individual things that all impacted on one another and they’d missed the overall picture, it’s called

24

Aspect of rigour


Interview fragment

understanding of multiple failures and vulnerabilities

cumulative degradation, that’s our catchphrase, it’s where you have a lot of different things going wrong or potentially failing and the companies will quite often will risk assess these individual things and put in measures to make sure they don’t cause a problem, but that’s in isolation they don’t look at the whole picture’

Being system-atised

Rigour as ensuring opportunistic actions do not undermine planned activity and controls

‘I imagine they were struggling to get work done, they had a big project coming in and they knew they wouldn’t have any bed space for all of the people they needed to do the work, but then something happened which meant that the installation had got to shut down for a …nothing to do with them, had to shut down so they were thinking how can we bring this work forwards …oh look we’re doing a job on this particular piece of plant and we’ve got some isolations in place for that could we use those isolations to do some of the work that we wanted to do in a few months time …let’s do that and after not very much planning they went ahead to do this bigger job but the isolations in question, you know the isolations that were in place, were not compatible with the isolations that were being required for this subsequent and larger job and you know a permit to work has to be made up, risk assessment has to be done there’s got to be quite a bit of discussion and basically what happened was a fitter went out and he ….started taking apart pipework that wasn’t isolated… he should have been accompanied by a process operative who would have been in a better position to know what was isolated and what wasn’t isolated but that didn’t happen’

Being unequiv-ocal

Rigour as avoiding impressions of equivocality about safety

‘I think it’s very, very important that you’re not seen to have two faces, that some of the time you’re talking about health, safety, environmental management but most of the time or some of the time you’re talking about business, the two absolutely just have to be intertwined’

versus production

There are both similarities and differences in the aspects of rigour that emerged from the accident report analysis and the interviews. But it is hard to read any significance into these, as both parts of the work involved relatively small samples.

25

5 RELATIONSHIPS AMONG THE ASPECTS OF RIGOUR

5.1 ASPECTS OF RIGOUR THAT OVERLAP

In many ways the aspects of rigour overlap. For example, being communicative and being engaged involve ways of behaving that look very similar in practice and have similar ends in overcoming natural tendencies towards fragmentation. Being moderate and being circumscribed are both concerned with the self-limiting qualities of organizational attention to an issue. The former is more about taking particular doctrines to excess (like withdrawing bread knives on health and safety grounds), and the latter is more about acting with a zeal that organizational capacities cannot match (like implementing a programme of change faster than the ability to inform the workforce can accommodate). But they overlap and both are likely to be relevant together in many situations.

One reason why different aspects strongly overlap is that, although we have identified aspects of rigour that are distinct in theory – the labels mean different things – in reality particular practices typically deal with more than one aspect. What people do is not driven by theoretical labels and even specific actions often address more than one problem. For example, being painstaking and being situated are both served by the practice of being good at detailed problem solving. Another reason why the aspects overlap is that they are inevitably connected up in a complex world. For example, being situated is related to being engaged in the sense that it can be because you are situated (and skeptical of the validity of general rules and instructions in specific situations) that you see it as being worthwhile to stay engaged with other parties working in the vicinity. Being situated and being engaged do not mean the same thing: but they probably tend to go together.

Another reason for the overlapping is that some actions can be rigorous for more than one reason. For example, investing in maintenance is intrinsically important and may overcome tendencies to economise, especially when revenues are diminished. But it may also be important in avoiding cynicism in a workforce that is used to hearing about the importance of safety while seeing the apparent neglect of maintenance. As one interviewee said:

‘I think it’s about showing them walk the walk rather than just talking the talk and it’s very easy just to say one thing but actually follow it through and actually stick by the promises and actually deliver on what they say they’re going to deliver and show something real and tangible to the workforce… [what] the safety reps fed back, voluntarily was that they felt since we had taken over these assets, they were very complimentary because they had seen evidence of that investment. They had seen everything from refurbished accommodation, galleys to … you’ve finally fixed this piece of kit or there’s a commitment to spend money and they’re actually seeing delivery...’

5.2 ASPECTS OF RIGOUR THAT APPEAR CONTRADICTORY

However, some of the aspects of rigour look distinctly contradictory. For example, the quality of being situated – meaning that the way of carrying out the activity should be responsive to local conditions and not unthinkingly generic – looks contradictory to the quality of being ‘uniform’ – meaning consistent across places and times. Both qualities serve important and obvious ends, but can point in different directions on any given occasion. This is reflected in the literature that in some places emphasizes local adaptation as a primary source of catastrophic

26

failure (for example Snook, 2000), but in others emphasizes the importance of getting beyond the use of general concepts and categories (for example Weick and Sutcliffe, 2006). The qualities of being ‘multicentred’ and being ‘engaged’ can also look contradictory. Both were found particularly in discussions of safety organizations, and how far they should be separated from the operating part of an organization. The issue is that, in most people’s accounts, a safety organization is a problem if cannot remain independent, but it is also a problem if it is not engaged with an operating organization, and staying while engaged while staying independent can appear contradictory.

Similarly, the capacity to be ‘relentless’ and the capacity to be ‘painstaking’ could both contradict the capacity to be ‘moderate’ in particular circumstances. Thus some interviewees’ observations supported the importance of moderation – for example where precautionary rules seemed to be applied to trivial cases with the effect of simply making people cynical. Other interviewees’ observations supported the importance of taking pains with small things, both because they had the potential to lead to bigger things and because this signaled their seriousness about safety.

Even within the same interviews people sometimes seemed to suggest contradictory strategies. For example one talked about managing contractors, and at one point advocated the practice of using commercial contracts to give people the right incentives toward safety (and avoid the wrong ones that simply stressed production):

‘one of the things that we do [is] to ensure our contractors are motivated, to have good T’s and C’s… by having incentive clauses within our contracts for things like attrition and performance and stuff like that’

But at another point the same interviewee said the best way of influencing contractors was by socialization not contracts:

‘my experience is that you have to work with your contractors, it can’t be a carrot and stick thing, you have to work with them, ensure that we all understand what our common goal is in terms of … performance and what we’re trying to achieve and basically talk to our contractors if we do have concerns… it’s no different than performance management on staff.”

Sometimes interviewees spoke quite consciously about the ‘paradoxes’ they observed, for example between the value of standardization and the value of specificity (or being uniform and being situated):

‘… I mean each transition is different and they’re all the same…its paradoxical like that, the issues are always going to be the same, the solutions…you’ve got to think of each one separately I mean we are looking at an overseas one a central European one at the moment ... mature oil field, dismal production, completely different culture and yet we’re able to use, at least I think we’re able to use, that’s what we’re proposing to use, the framework of our standard transition plan but we know that when we actually start doing the detailed planning a lot of that is going to change…’

5.3 ASPECTS OF RIGOUR THAT APPEAR AMBIGUOUS

Contradictions of the kind just described arise because, in a complex organization, any practice or way of behaving seems almost bound to produce a multiplicity of consequences (see for example Jervis, 1997), some favorable and some not. But problems with labeling a practice as rigorous also arise because the idea of ‘rigour’ leaves open a lot of room for interpretation. For example, there was an example described in one of the interviews where a sacking over safety was portrayed as vindictiveness. In cases like this, rigour could be construed as being ‘sticking to your guns’ and doing what you think is right, regardless of politics. But rigour could also be construed as the opposite – of acting in a way that takes account of politics because that is how

27

to maintain the social relationships that are needed to ensure you influence people on safety issues. It is not just that sacking someone has mixed effects, but that it can be given meaning in quite different ways, as both rigour and the absence of rigour.

In another example, one interviewee criticized HSE’s categorization of leaks, criticizing HSE action that had been taken against his company partly because of the way a small hole leaking over an extended time, in the open, had been misleadingly categorized as a significant release. An aspect of rigour in this account was therefore the need to avoid relying on crude categorizations and instead understand detailed influences on failure. This is consistent with work in the literature on ‘mindfulness’ and the need to avoid relying on crude categorizations to deal with widely varying situations (for example Weick and Sutcliffe, 2001). But it could equally be argued that being rigorous involves being committed to your rules and categories, and not blurring their boundaries for the sake of easy relationships with others. In the same interview, the interviewee talked about having over-reported leaks to HSE in the past, and explained how – by considering what had to be reported by law and what was in some sense really hazardous – the firm could now report many fewer leaks. You could argue that this was a rigorous approach to take because it tried to differentiate what really mattered from what didn’t; but you could also argue that it would be rigorous to report everything on the basis that a more moderate approach allows convenience and self-presentation to determine what is reported in practice. And another interviewee in the same organization in fact said just this, and claimed that it was essentially corporate policy to report and attend to all leaks of any magnitude.

5.3 BEING RECURSIVE ABOUT RIGOUR

The way in which the aspects of rigour overlap suggests that they cannot stand alone, and must be seen as parts of a picture that only makes sense as a whole. The way in which they seem contradictory suggests that different ways of being rigorous might be needed in different circumstances. And the ambiguity of what being rigorous means in any given case suggests that different ways of being rigorous can be made to work, perhaps even in similar circumstances. In all, it does not make sense simply to say there is one way of being rigorous, nor that the various aspects of rigour listed in Section 4 are independent qualities of practice that can be tested for, one after the other. Instead, being rigorous seems to be a matter of choice about how to be rigorous, and this choice itself needs to be a rigorous one. If you cannot lay down one way of being rigorous for all occasions, you have to have a capacity not only to be rigorous, but to choose the right way of being rigorous.

Moreover, these aspects of rigour are also qualities of organization that respond to some threat or problem – so, although they are a stage beyond the organizational responses to whose by-products they are directed, they are still organizational responses. They are themselves therefore sources of problems in their own right. This seems obvious when looking at them individually. For example the quality of being ‘engaged’ in isolation is problematic when the engagement is with someone or something that has become discredited or ineffectual. Being engaged cannot be counted as an unequivocally useful quality. It is generally a good way of dealing with other by-products of organization (like natural tendencies to concentrate on legal and contractual controls over relationships), but it can pose its own problems. Such aspects of rigour can similarly be problematic when they seem to undermine general, and useful, social norms such as mutual tolerance. The idea of peer monitoring and ‘behavioural safety’, for example, can lead individuals to confront others in a way that could be perceived as dimishing another’s status, or even as aggression. It then becomes important to have a strong process of acculturation that gives people the expectation that peer observation is normal and routine, and not an infringement of an individual’s freedom or privacy. For example, one interviewee said:

28

‘We role this out to all the crews, look you’re going to get STOPPED, its not an act of aggression, if you’re used to STOP we encourage to use it as a tool… if you see something you don’t think is safe if you don’t feel confident about voicing it …identifying yourself, do it anonymously, stick a hazard card in the box and tell someone you’ve shoved it in there and I will come and get it… it is emphasised that hard on every induction for every vendor and visitor, for our own people it’s literally ingrained into them… I mean if you’re on a job you’re more than likely [if you’ve got a permit out] have somebody come over and have a chat… a chat with you about it…it sounds like an informal conversation, it’s not an act of aggression.’

All this suggests that you have to be rigorous about being rigorous. You have to have good ways of choosing which of the aspects of rigour to apply in particular circumstances (for example whether to be more situated or more uniform), and you have to be attentive to the by-products of your choice. This is being ‘recursive’: applying a way of thinking or doing to some problem, but also applying a way of thinking to the way of thinking, and so on. Sometimes it is quite explicit, for example in the practice of auditing audit processes:

‘we audit the audits, we assess whether the audits have been done correctly, who’s done them, are people trained to do them … we will look at a sample of the audits.’

Similarly another said: ‘So you’ve got a triangle effect of corporate audits. At the very top where you do two or three or four a year. You’ve then got a kind of divisional management level and you’ve got an operational management level and then you’ve got the operational execution level offshore. It’s a bit like a triangle for fatalities for 600, you know, near-misses or whatever down here. It’s a bit like that you know, you’ve got a much much broader base of numbers in terms of we do stop audits, we do monitoring audits, we do compliance checks and that kind of thing.’

Another way of looking at this is to say that acting rigorously is itself a practice, and like all other practices it will have preconditions, maintenance requirements, and by-products: so it wouldn’t be rigorous not to apply the same standards to being rigorous. Figure 3 is intended to illustrate this.

Figure 3 The recursive nature of rigour

i ivi•

di li

i

Rii

• ll i

it-to-

i i

rii

• itiit-

to-

Bas c act ty Eg

smant ng process equ pment

gorous pract ce

Eg fo ow ng a permwork system

Be ng r gorous about the

gorous pract ce

Eg aud ng the perm

work system

i i

rii

• ( ) ini

i

Be ng r gorous about the

gorous pract ce

Eg re tra ng

the aud tors

etc

It is similar to the problem of who guards the guards. As soon as you set up a way of protecting the reliability of some system with some device you have to work out how to protect the reliability of the protective devices. We accept there is a never a point at which you can stop protecting the means of protection, logically. In practice you go as far as you reasonably can, but any profound understanding of the problems of protecting systems has to incorporate this idea of recursion.

29

An example of how rigour seems to be recursive, not just complex, is in the issue of ‘blame cultures’ and ‘just cultures’. Traditionally, perhaps, there has been a strong understanding in organizations that accountability is important, and it is natural that following failure this accountability is translated into blame. But then there has been an understanding that this has by-products, not least that it leads people to cover up failures and avoid reporting potentially informative errors and near misses. No-blame cultures, in turn, seem to have had their own by-products, such as an indifference to getting to the bottom of issues for which no-one can be blamed. We therefore have a more refined idea in terms of ‘just cultures’ – which a number of interviewees referred to. But again, these also produced problems, for example:

‘I don’t agree with the just culture system, no... I think it breeds a culture where people are less willing to discuss any failures, or any mishaps, in other words keep quiet if something were to happen or a near miss they would be less likely to report near misses that might have happened, they got away with it…and they might just say well I won’t mention at all because otherwise I’ll get grief I’ll get a just culture….so it’s easier and simpler not to say anything… I mean at one time very early on when I came on this platform we didn’t have this just culture and if anything occurred people were more willing to mention it and say well that was a near miss and share the lessons learned amongst the team and very, very occasionally we would get the guy involved to sit down with the team and just go thro what happened, no pressure, no comeback, no just culture and I think that’s a far better system…’

So the just culture has its own problems and by-products, like the fear of a miscarriage of justice, and the burden and embarrassment of going through the just culture procedure. So the problem is never definitively ‘solved’. You just keep refining your practice from day to day as best you can, and at any stage you should always bear in mind the by-products of your chosen approach (rather than think the problem soluble) – and then move on to the next problem.

5.4 SOME CONNECTIONS WITH EARLIER LITERATURE

There are various themes in the literature on organizations and organizational reliability to which this notion of rigour is connected. One is the idea that social organizations produce defences against the important problems of embarrassment and losing face – but that the by-products of doing so are ‘misunderstandings, distortions, and self-fulfilling and self-sealing processes’ (Argyris, 1990). From this emerges a concept of ‘double-loop learning’ that can deal with errors in governing values, not merely perturbations in the environment. Another theme in the literature is the idea that organizational reliability requires us to think in terms of systems, where the entities we are trying to manage are inter-connected in ways that produce feedback loops of one sort or another, and effects that our intuition tends to ignore (for example Jervis, 1997). We have to expect any action we take in complex systems to have by-products of various kinds. This leads on to a third theme in the literature – that of a ‘law of unintended consequences’, arising ‘from individual actions and the collisions and coincidences among them’ (Vernon, 1979). Part of the problem is that we often have to act with confidence when the information available to us is incomplete; part of the problem is making errors, including wish fulfillment; and part of the problem is that our concern with the immediate consequences of some action tends to exclude consideration of other consequences. Yet, because we never act in a psychological or social vacuum, the effects are bound to ramify into other spheres of value and interest (Merton, 1936). A fourth idea, mentioned in section 2, is that of collective mindfulness (Weick et al, 1999) and the need to avoid becoming trapped by the concepts and categories we have learned. In other words, however much these concepts serve us, they also impede us, making it difficult to appreciate new situations that they do not readily fit.

30

The concept of rigour, as a capacity of an organization to continually respond to the by-products of its own responses, therefore broadly fits in with an existing body of thinking. This stresses the way in which organizations lose reliability arises as much from the way they deal with the world as with the problems the world inflicts upon them. And it stresses the continuous-ness of the task of adaptation, learning, improvement, problem solving and so on. The task is hampered if you approach it with the idea of completing it once and for all.

31

6 RIGOUR IN NEW ENTRANTS

The working thesis has been that new entrants as a group are not uniformly less safe or more safe than established operators – and that you need to look in depth at their processes and practices for the quality of rigour. What is a ‘new entrant’ is also a matter of definition or convention rather than an obvious grouping of firms, and very much a matter of degree. Nonetheless, firms that establish operations in new parts of the world, firms that take on expanded roles and firms that acquire installations from others face distinct challenges. They have to find ways of being rigorous in particular connection with a number of issues: 1. Managing the transitions when an installation changes ownership. 2. Dealing with the legacies inherited from previous operators, both in equipment and culture. 3. Adapting to conditions in the region, for example becoming acquainted with regulatory

expectations, and with different labour market conditions. 4. Adopting new, or hitherto relatively unusual, organizational arrangements, for example

separating ownership from being a safety case duty holder.

6.1 MANAGING TRANSITIONS IN OWNERSHIP

One of the main issues involved in transitions seem to the stability of the workforce. For example:

‘if you have an all staff people environment and change that with the same people which is what happened effectively when [company X] took over the [A] asset they changed the business model primarily to cut costs, because [A] was a very high operating cost asset and even [company Y] were trying to cut costs by 20%, so when [X] came in, one of the ways to do it was to totally change the business model so rather than primarily a 90% insourced staff organisation they went totally the opposite way, making it primarily an outsourced organisation, onshore and offshore. But turning the majority of staff people into contract people – that just created 18 months of heartache and pain, there was again, totally dissatisfied people because one minute they were working for an oil company, the next minute working for a contractor, contract terms and conditions a lot less than the operator, offshore they were on a 2 and 3, they went to a 2 and 2, on the basic … rates so there was no way… they were going to stay… we couldn’t keep sufficient number of competent people offshore to run the facility…’

The same interviewee went on to say: ‘…and I think one of the ways we stabilised that was to have one of the best packages for contractors in the UK sector, and certainly we’re [company Z]’s best contract to work on by far within the UK, so improving their package really, salaries, bonuses, rotas we needed to do that to stem the flow a bit, but it’s stopped so I guess we achieved what we need to do, and I guess the market’s slowed down a little bit… but I think the primary mover was [us] putting money into it to try and improve the package so that people would want to stay.’

Thus aspects of rigour that were stabilizing seemed to be particularly important in managing transitions.

But it was not always approaches that aimed at maximizing stability and minimizing changes in the workforce that seemed most effective. Another interviewee talked about the beneficial mixing and renewing effect of recruiting a new staff with diverse backgrounds, for instance:

‘I found when we got our technicians on board they came on with various experiences [and knowledge bases] and it was actually good to throw that all into the mix because if you keep a core of [company X] people they will always do it the [X] way, and it might

32

not be the right way so it was good to have a total clearout near enough and just have 4 or 5 guys, the rest of the body mix was new… [but in another location] they’ll have a major issue because all the guys are swapping across, they’ve not got voluntary severance, it’s the spirit of TUPE, they’re going across with, and they’ll be lacking new ideas to get these platforms up and running and make them more effective because they’ve sold the existing guys that have been there for 25 years. And that’s why [installation A]… from the transition till now we’ve just improved, improved, improved because we never had guys that had this asset history that wanted to stay doing it the [X] way so that’s how we came on leaps and bounds, different ideas and innovation.’

The way in which different interviewees stress almost opposing approaches – stabilizing a workforce or comprehensively renewing it – indicates that different organizations, perhaps in different circumstances, find it necessary to be rigorous in quite different ways.

6.2 DEALING WITH LEGACIES

The issue of dealing with legacies involved such problems as uncertainties in the physical condition of equipment and in documentation – for example:

‘…historically in some cases it’s quite important… to be able to refer back to the documentation. But not all the documentation was handed over. I guess in some cases there may well have been issues around intellectual property that made that [things] difficult. But in other cases it was simply just very difficult to get, the documentation process had probably lapsed in some cases because the asset was no longer considered to be a viable concern’

Similarly: ‘I think what we have learned… before you take something over it is very difficult to get a comprehensive view of what you are taking over, I think there is a lot of commercial issues that would prevent people from allowing you offshore effectively… but the moment we’ve got the key then we should be all over the place and do a very, very thorough review and we are setting ourselves up for that for future acquisitions if we are going to make any… we would have to do a very thorough review after having taking over the facility because I think realistically it is difficult to access before...’

Experience varied as to how problematic the legacy was. For example: [X] [established firm] had got themselves in such bad odour with the HSE and everyone else in the North Aea that they had taken the opposite tack and spent huge sums of money in getting them back up to a saleable standard…and I mean a lot of money, there is still a lot to be spent, tens of millions of pounds to be spent but [X] had spent, I don’t know, a hundred million or something like that in the 2 or 3 years before they put them up for sale. [interviewer] So… some good has come from it and companies no longer think they can actually pass on assets [in poor condition]? [interviewee] I’m not saying it will never happen again but certainly it’s a lot less likely, this one was stripped in effect and run down… there was a deliberate reduction in what I would call the bread and butter maintenance, fabric maintenance, preserving the long term integrity of the asset by [Y] [established firm] who had bought it from [Z] [established firm], didn’t really want it, they wanted other things from [Z] but they didn’t want this so when it got absorbed in [B] [region]…there was almost a... an unhealthy glee over stopping a lot of the work that was going on in the [A][installation] just cut back, cut back... and of course by the time [V] [new owner] got it that was pretty obvious.’

Management of legacy issues was problematic both because systems were run down as the installation was nearing the end of its expected design life, and because of concerns about commercial confidentiality that impeded the exchange of information.

33

The emphasis was not entirely on the physical legacy that new entrants had to manage: there were also issues surrounding the adequacy of inherited procedural systems. The acquiring organization therefore needed to expect to overhaul the procedures it inherited, although this was sometimes seen as part of what should be a regular overhaul:

‘[interviewer] As part of your process I take it you start checking the procedures, to make sure… [interviewee] Oh yes absolutely. [interviewer] What sort of time frame are you looking at? [interviewee] I would think that within a 12 month period from transition date, that… you’ll find that most procedures have a review date of 12 months anyway… we actually introduce an active monitoring programme which is tier 3 which is local level and… that active monitoring includes reviewing the actual procedures associated with those activities so at a local level they’re actually reviewed and if there are anomalies then that information is passed through to onshore and that’s when that particular procedure is given a more detailed review.’

Aspects of rigour that were particular concerned with maintaining currency seemed important in cases like this.

6.3 ADAPTING TO CONDITIONS IN THE UKCS

One of the challenges of adapting to conditions in the UKCS was understanding the roles and powers of the regulator. One organization, according to interviewees, had not fully appreciated this when they entered the sector and appeared to show little willingness to find out what these roles and powers were. Another organization, according to its members, had shown more or less the opposite attitude. Thus ‘engagement’ as an aspect of rigour seemed important. Some interviewees felt that they were naturally the subject of greater attention from the regulator, for example:

‘We are not necessarily the easy target but we are an area of interest to them because they are… the old, old assets with a new owner who’s got money to invest and an interest and everything and as they take something from the old and quite steady state or maybe even declining and try to ramp up activity levels on something that’s quite old… it’s like taking your old fiesta and trying to rally drive it… so by the step change and change in culture and activities that we’re doing we are finding ourselves in a much more hazardous environment and we’re getting a lot of interest and inspections as a result.’

A second challenge to entering the UKCS involved understanding the conditions and norms in the labour market. Again, one organization seemed unable to appreciate these, according to some of the interviewees. The claim was that the UK workforce was particularly itinerant, and this made it important to have comprehensive codes and standards. The organization in question resisted this because it preferred to rely on people’s competence, which it had been able to do historically with a more stable workforce.

More generally, in the context of new entrants, an important aspect of rigour is realizing that your inferences about how best to organize your affairs arise from your particular historical experience. It is important to be sensitive to how different conditions can make these inferences invalid as you extend your activities or the world changes.

6.4 ADOPTING NEW OR UNUSUAL ORGANIZATIONAL ARRANGEMENTS

On the issues raised by the adoption of new or unusual organizational arrangements, like the separation of ownership and operation, interviewees in one firm particularly talked about the difficulties that had arisen in the triangular organizational relationships that arise. For example

34

an owner may contract a drilling company while contracting an operating company to act as the duty holder. This creates possibilities for unforeseen conflicts in activity and responsibility that are more readily seen and dealt with where the owner and duty holder are the same organization. An obvious aspect of rigour in such cases is a strong engagement among the relevant parties. For example:

‘So the reason the interface was developed was to try and get the well operator and licensed operator, the drilling contractor and our own people to understand it’s not just a case of leaving [X] or [Y] to talk to [Z]: we have to get involved in the conversations too.’

There also appeared to be a more extended decision making process when the main fundholder was not the duty holder. For example:

‘…being in [X] [duty holder but not owner] isn’t like being in [Y] [owner is duty holder] where you know somebody comes up with an idea and it gets fed up and you know all the people in the chain and they think oh that’s a great idea lets do that. What happens is that somebody comes up with a suggestion and we think yes absolutely we need to do something about that, that’s great and then it goes all the way up the chain. And then it gets as far as the operations manager and director and it’s like yes that’s great but we need to get, we need to pay for it somehow, and therefore it needs to come out of opex budgets. And so, and then we have to pass that cost back to the client and the client will say I don’t see why we need to pay for, why do we pay for that? That’s a [X] thing. And then it gets into this kind of vacuum. And so certain things will make it through but I would imagine that there are a fair degree of excellent ideas and things that we should be getting after and fixing that don’t manage to make it past that stage.’

Such situations point to an important aspect of rigour as having organizational mechanisms that ensure adequate resourcing in the context of more complex commercial situations. The fact that a duty holder had a commercial relationship with the fund holder as client could also be problematic in exerting the kind of authority needed to meet a duty holder’s responsibility:

‘[interviewer]…you said to me on the [X] about this master – servant relationship… [interviewee] it does, it makes it extremely difficult and as a consequence of that it puts people in difficult situations when it comes to actually challenging what the client is doing.’

So rigour in such a context is also about being principled or dutiful: about having a clear sense when there is a duty to be performed even when commercial conditions or relationships make it difficult.

Generally, the study indicated that being a new entrant does not require a different kind of rigour. Qualities such as being reflexive, being dutiful, being fully resourced, being strongly engaged and so on seem to apply equally to all organizations. Such qualities can be obtained in different ways, of course: reflexiveness can be systematized and embedded in an organization in codes and procedures, or it can be realized in a much more informal way as a cultural expectation of people who work in the organization. But the quality itself is so general that there is no type of organization that does not need it. Nonetheless, it was evident that new entrants operate in different circumstances from established firms and sometimes pursue different ways of organizing. What they have to be rigorous about is therefore distinctive, and scrutinizing activity in new entrants means looking at their capacities to be rigorous in those things that present them with particular challenges – as indicated in Figure 4.

35

Figure 4 Rigour in the context of new entrants

i

• iiti

• li il

• iiti

l i

• iiali

• iengaged

• il i

•

Context of be ng a new entrant

Manag ng trans ons Dea ng w th egacy Adapt ng to new cond ons and arrangements

Genera aspects of r gour

Be ng soc sed Be ng

Be ng ref ex ve Etc

i l ly l

ri

Part cu arre evant aspects of

gour

Scrutiny

In addition to the kind of new entrants involved in this study – established and substantial firms that moved into the UKCS, usually by acquisition – there is a population of small companies which are new organizations, perhaps typically involved in a single well subsea development with a tie-back to a nearby platform. The platform operator will be the safety case duty holder, rather than the companies in question. Such companies were said by interviewees to be ‘lean and mean’ and ‘maybe cut corners a bit sometimes’ but ‘don’t have all the hierarchy and the slow decision making of the multi-national’. Although they have duties under health and safety law, because they are not safety case duty holders they ‘probably aren’t on the HSE’s radar’. Nonetheless their presence is significant, not least because they are probably tomorrow’s safety case duty holders (Moody, undated), because their funding pattern seems to leave them with little resource to invest proactively in safety, and because they may have little understanding of regulation in the UK sector.

The basic idea of rigour – as responding to the limitations of your own responses – is as valid to such organizations as it is to larger and more established ones. The difficulty is perhaps that small and young organizations are unlikely to have a formal or visible capacity of this kind. This is likely to be exacerbated if the basic rationale for such organizations is to avoid overheads, since the avoidance of overheads seems to demand a concentration on basic production processes. Nonetheless the idea of rigour does not point to a particular organizational form: if anything it points in the opposite direction – to the idea that different forms are equally valid. And it seems possible to test the rigour of a small, lean firm’s practice as much as a large, established one’s. For example, one of the aspects of rigour listed in Chapter 4 was that of ‘essentialism’: of concentrating on the essence of what you are doing, to avoid over-elaboration and over-complexity. Short decision paths and short decision times are also likely to make practices more ‘completed’: in other words, lines of investigation and development are more likely to be brought to rapid completion.

36

7 LEADERSHIP AND RIGOUR

The concept of rigour is naturally associated with questions of leadership because it has connotations of taking an approach that is somehow better than the merely adequate, the habitual or the routine. It suggests a need to step beyond comfortable and perhaps familiar ways of acting. It is therefore unlikely to come about and be maintained without certain people exercising leadership: having an understanding that is in advance of their peers’ and colleagues’, being prepared to follow through on this understanding, and exercising what influence they have to promote it. This can perhaps be seen in at least some of the aspects of rigour listed earlier. For example reflexiveness – looking at your own processes and being candid about their limitations and by-products – is not necessarily a straightforward process. The idea that organizations place obstacles in the way of ‘double-loop’ learning is well known in the literature (for example Argyris, 1990). It takes someone to risk unpopularity, criticism and even ostracism to promote the cause of reflexiveness in an organization that is unused to it. Even the more pedestrian aspects of rigour, like ensuring activities are well resourced, can require acts of leadership when resources are short – a situation that seems to arise for at least part of the business cycle in the offshore industry.

It is interesting that the term ‘organizational defences’ can be used both in the pejorative sense of defences against embarrassment that stop organizations learning (Argyris, 1990) and in the more approving sense of defences against hazardous occurrences that stop the development of accidents (Reason, 1990). But the two do not seem to go hand in hand. The capacities that organizations naturally seem to develop to deal with threats to their self-esteem, status and public image are not the same as the capacities they need to deal with threats of breakdown and catastrophic failure. If anything, developing the former seems to make it harder to develop the latter. Developing the latter, and developing rigour in particular, seems to need a particular will and exercise of leadership.

The link between rigour and leadership is not one-way, however. While leadership is needed for rigour, it makes sense also to say that rigour is needed for leadership. People can lead in a formal, nominal or token sense, and we speak of ‘leaders’ as those who have nominal authority, sometimes while disparaging what they actually accomplish. But we also have a notion of profound or genuine leadership that involves some capacity or performance that is ahead of what is normal or routine. This looks like leadership of a more ‘rigorous’ kind. There is therefore a bi-directional relationship between rigour and leadership, as indicated in Figure 5. Rigour does not inherently exist in organized activity and leadership is needed to bring it about; but leadership itself is not inherently influential, or influential in the right direction, so needs to have the quality of rigour if it is to accomplish much.

Figure 5 Rigour and leadership

Rigour as a necessary

Rigour quality of leadership

Leadership

Leadership as being necessary to the achievement of rigour

An important element of leadership is promoting the idea that experiencing the by-products of a practice is not a reason for abandoning it. In one of the firms participating in the study, interviewees particularly talked about the highly socialized nature of its practice. Several of

37

them recognized the problems this caused. But their remedy was not to give up on the practice: it was to become more aware of its nature and its consequences, and deal with those in turn. They also made frequent references to certain individuals whose commitment to the practice seemed to be highly influential on the workforce, and they spoke of it as a basic element of the organization’s identity, for example:

‘…I think that is a great base to work from because it’s supported in [head office], it’s supported [by] senior management in the UK, and from us to offshore, so that message of doing the right thing and how we deal things is just at important as the result, is instilled right throughout the organization.’

This sense of it being basic to the organization seemed to provide assurance that the practice was one to remain committed to, despite its drawbacks.

What seems to go hand-in-hand with the risk of giving up on a valid practice because of its by-products is the risk of avoiding a valid practice by adopting coping strategies that help people cope but prolong or maintain a problem instead of solving it in any profound way. This is found in the organizational literature. For example, Argyris (1990) discusses cases where managers realize their presence in meetings can be inhibitory, so encourage others to meet privately to discuss issues in the open, and then bring the outcomes to them. The problem is that such practices perpetuate the division between managers and subordinates. This same issue arose in the interviews, and it was seen as a considerable step forward when OIMs could be invited to safety representatives’ meetings, and when it was realized this need not inhibit the discussion in those meetings:

‘but increasingly ….some of the OIM’s ask particularly… there’s one who joined the company latterly… he didn’t shoe-horn his way in, he asked questions of the safety reps and said would you put the questions to your work force, would there be an objection to me either speaking for 10 minutes, only by invitation, or would have people have any objection to me sitting in the safety meeting and so…it went across five shifts… they decided no, they hadn’t got anything to hide whatsoever and if they want to say something in front of an OIM they didn’t feel impeded by the physical presence of any of the 3 OIM’s which I think is extremely positive.’

This practice of direct engagement has the by-product of inhibiting certain kinds of exchange, but is nonetheless a valid practice. It is probably better to deal with the by-products than avoid the practice. Coping strategies, like excluding OIMs from safety representative meetings, ultimately get in the way of adopting the practice. In cases like this it looked very much like an act of leadership to overcome the coping strategy and make a commitment to what was felt to be the right practice.

Perhaps the most important aspect of rigour that would be associated with leadership would be socialization – since leadership is naturally seen as a social act. This had different levels of prominence in different organizations, and interviewees themselves spoke about quite stark contrasts between organizations that relied heavily on bureaucracy and those relying on extensive negotiation. The latter were strongly socialized in the sense that their activity relied heavily on systems of social obligation rather than formal legitimacy and formal obligation. But bureaucracy and socialization were not mutually exclusive. One of the more important aspects of a socialized approach was that it recognized that procedures were sometimes violated, despite their logical importance, because individuals became cynical, or complacent, or lacked understanding of the full rationale for codified ways of working. This led to a recognition of the need to consult, negotiate and use social resources like informal norms and feelings of obligation toward others in order to achieve compliance.

Socialised approaches also seemed to be necessary because procedures simply didn’t yield enough information. For example, interviewees talked about the practice of having ‘huddles’ to review planned permits to work where the work in question would produce interference

38

between different tasks. Producing a socialized approach to activity seemed to need leadership because of an inherent tendency among some individuals to rely unrealistically on the logical or technical qualities of a procedure to persuade people to follow them, and to rely on formal authority to achieve what they thought to be appropriate. Being socialised was not inevitable.

Such situations suggest several stages to the development of leadership. At the most basic level there is an understanding of the importance of protective measures and practices, like safety meetings. There is an optimism about what they can achieve, but no particular recognition of their by-products and drawbacks. Leadership is needed because of the strong tendency in organizations to emphasise production goals. At the next level, there is a recognition that safety measures and practices do have limitations and problems, and these are taken as a reason to limit the commitment to such practices. They might be maintained for reasons of display as much as what is thought to be their intrinsic worth, and coping strategies emerge to deal with the problems. Leadership is needed to avoid unreasonable optimism, and an inability to see the by-products. But there is a further level of development in which there is a strong and heavily emphasized commitment to what are taken as being ‘right’ practices and qualities, together with a willingness to see their by-products and manage them in a way that does not dilute the basic commitment. Leadership is needed because a recognition of by-products is likely to make people equivocal and cynical. Figure 6 illustrates this.

Figure 6 Stages of maturity in leadership

Rig i ii liti i i -

i i li ici

orous: promot ng comm tment to mportant qua es, manag ng the r byproducts, avert ng equ voca ty and cyn sm

Developed: recognizing the limitations and drawbacks of protective measures and practices, limiting the commitment to them

Basic: achieving a concern with protection, overcoming preoccupation with efficiency and productivity, optimistic about protective measures

Maturity in leadership

39

8 RECOMMENDATIONS

8.1 LOOKING FOR ASPECTS OF RIGOUR

The first recommendation is that scrutinizing operations should involve looking for the aspects of rigour that emerged from the study. Whether this is done by operators themselves, or outsiders like regulatory inspectors, the way in which operators manage the needs and by-products of their own responses should be a central object of scrutiny. It is this that gets the scrutiny beyond merely ticking boxes – checking the nominal adoption of particular systems – and on to the deeper understanding and more effective practice of safety.

One approach is to use the aspects of rigour listed in Section 4 as a checklist. In principle you can look at an activity and assess whether these aspects can be found in the way the activity is conducted. This at least makes a start on getting beyond the surface form of the activity, and draws people’s focus towards the way in which they work, not just the work itself, and towards the nature of their practice and how well founded it is.

It is important to point out that the various aspects of rigour can be applied at different levels of generality. Some deal with very general by-products of organizing probably found in all organizations, whereas others deal with specific practices in specific organizations. One way of structuring the process of applying the list of aspects is therefore to look for rigour at these different levels, as indicated in Figure 7.

Figure 7 Applying the idea of rigour at different levels of generality

Aspects of rigour • Being socialized • Being reflexive • Being situated • Being systematised • …

Level of application • All practice in all organizations

o Eg tendency to self-referentiality • All practice in specific organizations

o Eg paternalistic culture • Specific practices in all organizations

o Eg putting safety ‘in the line’ • Specific practices in specific organizations

o Eg setting targets for closing out snags

8.2 LOOKING FOR RIGOUR IN THE ROUND

The problem with this approach is, as suggested in Section 5, that the various aspects of rigour sometimes overlap and sometimes seem to contradict each other, and in any case that what is rigorous in any given situation can be very ambiguous. A better test is the idea that rigour

40

ultimately means managing the by-products of your own processes of safety management. This means scrutinizing all safety management activity to see whether, for example, there is a commitment to a clear model of organization (for example putting safety ‘in the line’) and an equally clear commitment to dealing with its consequences (for example the loss of an independent view, or the loss of any ability to stand up to production demands).

A general commitment to the idea of managing safety by goal setting rather than prescription would mean that looking for evidence that an organization is being rigorous, in this sense, becomes more important than looking for evidence it has adopted specific practices. It would mean, for example, making no particular judgment as to whether a company should keep safety ‘in the line’ or give a separate safety organization executive powers. The only judgment is whether it fully understands the consequences of whichever approach it has chosen, and manages the consequences rigorously in turn. This may be difficult to do, if your experience has pointed to one practice being clearly better than another in some way. But it has advantages, and lets a third party such as regulator can take a view on an organization without taking a ‘side’, especially on the more political issues. It can take a view as to whether the chosen line of action has been taken with some recognition of the by-products and the maintenance needs; it does not need to take a view on whether the chosen line of action was somehow correct. It does not need to say ‘this sacking was appropriate’, or the opposite; but does need to say whether the sacking was done with an understanding of the consequences, and the consequences of the consequences.

8.2 RIGOUR IN RELATIONSHIPS WITH THE REGULATOR

Many aspects of rigour concern relationships between organizations, particularly between operators and contractors. These often look equally applicable to relationships between a regulator and an operator, and in fact some aspects of rigour specifically concern this relationship. Some essentially involve operators behaving in a rigorous way towards the regulator. But it is important to remember how organizations to quite a large degree create their own environments, and that operators’ responses to regulatory activity might reflect the nature of this activity as well as their natural inclinations. Therefore we think it is important that HSE can reflect on its relationships with operators in terms of their rigour, and perhaps use some of the analysis given above as a basis for doing this. For example, one aspect of rigour – linked to general ideas about ‘no blame’ cultures – is recognizing that the reliability of a system depends in part on the behaviour of whoever is relying on it in some fairly obvious ways. When people in interviews were asked about their relationships with HSE they often concentrated on whether what they perceived as HSE’s approach encouraged or discouraged them from being open, sharing knowledge and seeking advice.

Although this was not the main object of our analysis, the operators’ explanations of how to manage the relationship with the regulator diverged quite sharply. Some saw the HSE as a legitimate and useful source of ‘challenges’. This was part of a more general aspect of rigour that recognized the danger of an organization becoming inward-looking for its standards of behavior, and the benefits of having outside opinion or external norms to test behavior against. But others saw the HSE as a source of potential disruption to be minimized or mitigated in some way. One interviewee described a distinctly risk-based approach whereby the HSE was to be ‘kept at bay’, and the occasional ‘trouble’ with HSE being a part of doing business. And some had fairly critical opinions of both the validity and usefulness of HSE inspectors’ observations – criticizing their harshness, their narrowness and supposed lack of ‘practicality’, and the way in which they felt they were put ‘under a spotlight’. Whether these were valid accounts or not, they seem likely to have conditioned the way in which those who voiced them approached their dealings with HSE.

41

It is natural to think that the more positive attitudes among operators will elicit more engaged and helpful actions on the part of the regulator. Being sensitive to this was an aspect of rigour found in our analysis, and there is a literature on such effects: see for example Jervis, 1997, p. 49). So the operators’ and regulator’s management of the relationship between them need to be seen as co-evolving and mutually influencing. As with aspects of rigour in other relationships (such as those between operators and contractors) the essential element seems to be a strongly engaged approach, where the two organizations are sufficiently communicative that they can get into a virtuous circle of responding to the other’s concerns and being responded to in equal measure. This is perhaps especially important in the case of new entrants who, although they might have lengthy experience elsewhere, are new to the sector and to the regulator. As mentioned earlier, interviewees said there were wide variations between organizations such that one new entrant was a good deal more concerned with finding out about regulatory arrangements and norms than another.

But again it is important to see rigour not as a particular practice – for example engagement between regulator and regulated – but as a responsiveness to the by-products of your own responses. One of the problems of engagement for the regulator is that duty holders might see engagement as a dilution of their own responsibilities, leading to a perception that these are shared with the regulator. There was a sensitivity to this in interviews with inspectors. Some talked about the differing levels of receptivity among duty holders to regulatory advice, and pointed to the way in which large, established operators tended to have large technical staffs who could ‘push back’ against regulatory opinion. Yet inspectors did not voice a simple preference for the practice of other, usually smaller and newer organizations, to be more receptive to their advice. There was a recognition that some ‘push back’ could be desirable, and that the challenging was two-way rather than one-way. This seemed to help address the potential problem of duty holders believing their responsibilities to be diluted when they went along with regulatory advice. It could be seen as being ironic that a regulator would find it frustrating to be constantly challenged by duty holders, and yet – when it wasn’t challenged – not to be entirely happy about that either. But this consistent skepticism is perhaps exactly the quality that is needed.

Another difficulty with the prescription that regulator and regulated should be strongly engaged is that both parties to a relationship also have to respond to other aspects of their environment in the way they behave. Some interviewees explained what they saw as being a counter-productive ‘aggressiveness’ on the part of HSE as arising from the need for HSE to demonstrate that they were not being soft on highly profitable oil companies. This was by no means the consensus, but it is informative. As with all organizational responses, the question is what is the desired, main effect, and what are the by-products that need managing. If the main effect is influence over regulated firms then the problem of being seen as being soft is a by-product that has to be somehow managed. If the main effect is creating a good opinion then the problem of impeding the relationship with operators is the by-product that has to be managed – as indicated in Figure 8. The danger of not being clear about this is that you loose the main effect you want because you give up a practice on the basis of its by-product.

42

with operators

Figure 8 Determining the main effect and the by-product

il l i i

l i i i

ilici

i l l i i

By-

i il

ii i il

il i

i l l i i

By-

li i

l i ip

Ma n effect: He ps deve op nformat ve re at onsh p w th operators

Pract ce: Be so tous and engaged n regu atory re at onsh ps

product: Leads to mpress ons of regu atory capture

Ma n effect: Avo ds mpress ons of regu atory capture

Pract ce: Be guarded and eva uat ve n regu atory re at onsh ps

product: Impedes deve opment of nformat ve re at onsh

43

9 CONCLUSION

9.1 SUMMARY OF THE STUDY

The premise of the study was that what mattered most to safety was not specific organizational choices, such as how much activity to sub-contract, or how far to proceduralise this activity, but a deeper capacity to make such choices work. What came out of the study was a detailed understanding of what this capacity looks like at a concrete level. It typically involved answering not the direct question of ‘how does the organization deal with circumstances?’ but the deeper question of ‘how does it deal with the needs and by-products of its own way of responding to these circumstances?’

The empirical part of the study analysed accident reports and interviews with staff in five operating companies, and the regulator, in order to determine the specific aspects of this deeper quality, labeled ‘rigour’. These aspects were wide-ranging, often overlapping and in some cases contradictory. This, and the way in which behaving rigorously was also a practice that had its own needs and by-products, pointed to the importance of thinking about rigour as being recursive: you respond to safety issues in a particular way, then you respond to the by-products of these responses, then you response to the by-products of those responses, and so on.

The various, detailed aspects of rigour were shared by both new entrants and established companies. But new entrants were coping with specific problems that placed particular emphasis on certain of these aspects: for example, the need to manage transitions in ownership meant having practices that were robust to misunderstandings. Therefore the scrutiny of operating organizations involves a general consideration of whether they exhibit the various aspects of rigour, together with a specific focus on the aspects most relevant to their circumstances.

This notion of rigour seemed to be strongly linked to what is expected of leadership in the general realm of safety. Aspects of rigour seemed to be neither inherent in ways of organizing, nor particularly easy to achieve and maintain. It took positive effort, sometimes in the face of received wisdom and sometimes in the face of strong countervailing pressures, and involved an approach that was both committed to some particular way of organizing and yet was clear about its by-products. A simple framework was proposed that distinguished three levels of this leadership. In the first, leadership only got as far as solving the first-order problem: finding ways of directly improving safety. In the second, it recognized the problems that these in turn produced, but generally took these as a sign that improvement was inherently limited. In the third, there was a recognition that such by-products could themselves be managed.

9.2 LIMITATIONS OF THE STUDY

The first main limitation, as indicated earlier, is the partly subjective nature of a qualitative, grounded analysis. There is a good deal of latitude in how the framing ideas, in the case to do with ‘rigour’, are interpreted when looking at the data, there is a lot of subjectivity in selecting which fragments of an interview or an accident report fit this framing idea, and there is a similar subjectivity in labeling what aspect of rigour these fragments refer to. The defence is that the various aspects of rigour that came out of the analysis do not have to be definitive in order to be useful as a guide to scrutinizing organizations that should be being rigorous.

44

The second main limitation is that the data are similarly selective. The interviews were unstructured and what the interviewees explained, and how far they explained it, was a function of the direction established by the interviewer. And the particular explanations the interviewees chose to give was as much a product of being in an interview as it was of their experience at work. Accident reports are written by different people with different preconceptions, and similarly what gets reported is as much a function of the pressures on reporting as what the reporters really think mattered. The defence here is that neither interviews nor accident reports were used as sources of factual data about specific events: they were sources of individuals’ insights into how organizations produce safety, and the job of the analysis was to make sense of these in the round.

The third main limitation is that the study was based on the idea that it was important to study practice, not outcomes, and that the most important element of practice was how well it dealt with its own by-products. We started with the informal belief that new entrants as a group could not be proved either safer or less safe than established operators, so what was important for safety was not being a new entrant but how you went about being a new entrant (and similarly what was important about being an established operator was how you went about being an established operator). This was a premise, not a conjecture that was tested during the course of the study. It was a convenient conjecture, because it looked as though it would not be possible to measure the relative safety performance of new entrants and established operators, and even if it were it would be very hard to know what to make of the results. But it was a premise and we have not proved it in any sense.

45

9 REFERENCES

Argyris, C. (1990). Overcoming Organizational Defenses. Allyn and Bacon (Needham Heights,MA).Berg, B.L. (1989). Qualitative Research Methods. Allyn and Bacon (Boston MA).Bier, V., Joosten, J. and Glyer, D. (2003). Effects of Deregulation on Safety. Kluwer AcademicPublishers (Dordrecht).Bigley, G.A. and Roberts, K.H. (2001). The incident command system: high reliabilityorganizing for complex and volatile task environments. Academy of Management Journal, 44, 1281-1300.Bond, F.W. and Hayes, S.C. (2002). ACT at work. In Bond, F.W. and Dryden, W. (Eds.),Handbook of Brief Cognitive Behaviour Therapy, Wiley (Chichester UK).Bryman, A. and Burgess, R.G. (Eds.) (1994). Analyzing Qualitative Data. Routledge (London).Glaser, B.G. and Strauss, A.L. (1967). The Discovery of Grounded Theory. Aldine Publishing Company (New York).Grabowski, M. and Roberts, K. (1997) Risk mitigation in large-scale systems: lessons from highreliability organizations. California Management Review, 39, 152-161.Hutter, B.M. and Power, M.K. (2005). Organizational encounters with risk: an introduction. InHutter, B.M. and Power, M.K. (Eds.), Organizational Encounters with Risk. Cambridge University Press (Cambridge), pp. 1-32.Jervis, R. (1997). System Effects. Complexity in Political and Social Life. Princeton UniversityPress (Princeton, NJ).La Porte, T.R. (1996) High reliability organizations: unlikely, demanding and at risk. Journal ofContingencies and Crisis Management, 4, 60-71.La Porte, T.R. and Consolini, P.M. (1991) Working in practice but bot in theory: theoreticalchallenges of ‘High Reliability Organizations’. Journal of Public Administration Research andTheory, 1, 19-47.La Porte ,T.R. and Thomas, C.W. (1995). ‘Regulatory compliance and the ethos of qualityenhancement: surprises in nuclear power plant operations’. Journal of Public AdministrationResearch and Theory, 5, 109-137.Mason, J. (1996). Qualitative Researching. Sage Publications (London UK).Merton, R.K. (1936). The unanticipated consequences of purposive social action. AmericanSociological Review, 1, 894-904.Moody, G. (undated). UKCS Smaller Operators. HSE presentation material.Oster, C.V., Strong, J.S., Zorn, C.K. (1992). Why Airplanes Crash: Aviation Safety in aChanging World. Oxford University Press (Oxford).Pidgeon, N. and O’Leary, M. (2000). Man-made disasters: why technology and organizations(sometimes) fail. Safety Science, 34, 15-30.Rasmussen, J. (1990). The role of error in organizing behaviour. Ergonomics, 33, 1185-1200.Reason, J. (1990). The contribution of latent human failures to the breakdown of complexsystems. Philosophical Transactions of the Royal Society, Part B, 327: 475-484.Reason, J. (1997). Managing the Risks of Organizational Accidents. Ashgate (Aldershot, UK).Rijpma, J.A. (1997). Complexity, tight-coupling and reliability: connecting normal accidentstheory and high reliability theory. Journal of Contingencies and Crisis Management, 5: 15-23.Roberts, K.H. (1990). Some characteristics of one type of high reliability organization.Organization Science, 1, 160-176.Roberts, K.H., Stout, S.K. and Halpern, J.J. (1994). Decision dynamics in two high reliabilityorganizations. Management Science, 40, 614-624.Rochlin, G.I., La Porte, T.R. and Roberts, K.H. (1987) The self-designing high reliabilityorganization: aircraft carrier operations at sea. Navel War College Review, 40, 76-90.

46

Roe, E., Schulman, P., Van Eeten, M. and De Bruijne, M. (2005). High-reliability bandwidthmanagement in large technical systems: findings and implications of two case studies,” Journalof Public Administration Research and Theory, 15, 263-281.Sagan, S.D. (1993) The Limits of Safety: Organizations, Accidents, and Nuclear Weapons.Princeton University Press, Princeton.Sagan, S.D. (1994) Toward a political theory of organizational reliability. Journal ofContingencies and Crisis Management, 2, 228-240.Sagan, S.D. (2004). The problem of redundancy problem: why more nuclear security forcesmay produce less nuclear security. Risk Analysis, 24, 935-946.Schatzman, L. and Strauss, A.L. (1973). Field Research. Prentice-Hall (Englewood Cliffs NJ).Schulman, P.R. (1993) Negotiated order of organizational reliability. Administration andSociety, 25, 356-372.Snook, S.A. (2000). Friendly Fire: The Accidental Shootdown of US Black Hawks OverNorthern Iraq. Princeton University Press (Princeton, NJ).Strauss, A. and Corbin, J. (1990). Basics of Qualitative Research. Sage Publications (NewburyPark, CA).Vaughan, D. (1996). The Challenger Launch Decision. University of Chicago Press (Chicago).Vernon, R. (1979). Unintended consequences. Political Theory, 7, 57-73.Walker, R. (Ed.) (1985). Applied Qualitative Research. Gower (Aldershot UK).Weick, K.E. (1979). The Social Psychology of Organizing. Addison-Wesley (Reading, MA).Weick, K.E. (1987). Organizational culture as a source of high reliability. CaliforniaManagement Review, XXIX, 112-127.Weick, K.E. and Roberts, K.H. (1993). Collective mind in organizations: heedful interrelatingon flight decks. Administrative Science Quarterly, 38, 357-381.Weick, K.E., Sutcliffe, K.M. and Obstfield, D. (1999). Organizing for high reliability: processesof collective mindfulness. Research in Organizational Behavior, 21, 81-123.Weick, K.E. and Sutcliffe, K.M. (2001). Managing the Unexpected: Assuring HighPerformance in an Age of Complexity. Jossey-Bass (San Francisco).Weick, K.E. and Sutcliffe, K.M. (2006). Mindfulness and the quality of organizational attention.Organization Science, 17, 514-524.

47

Published by the Health and Safety Executive 11/09



The anecdotal experience of new entrants in the UK offshore industry is that they are not, as a group, safer or less safe than established organisations. Similarly, the organisational arrangements that are sometimes associated with new entrants – such as the separation of ownership and operation – are not clearly less safe than more traditional arrangements. What seems to matter more is a deeper capacity to make chosen ways of organising work. This particularly involves being ‘rigorous’: not just developing effective safety practices but dealing with the by-products and side-effects of such practices.

An analysis of a set of accident reports, and a set of interviews carried out with HSE inspectors and staff in five offshore operators, produced a detailed account of what this kind of rigour looked like in practice. The analysis also indicated that being rigorous was an organisational practice that itself had by-products needing to be managed. So rigour needs to be seen as a continual practice of being committed to particular actions and at the same time being attentive to the consequences. Rigour of this kind points to a strong emphasis on leadership – leadership that promotes an attention to refining practice that does not seem to come naturally or easily to organisations.

Organisations that were new entrants to the industry faced problems that made particular demands on their capacities to be rigorous. For example, they had to maintain safety while managing transitions in ownership and organisational culture, getting used to new labour market conditions and regulatory requirements, and coping with the physical and organisational legacies inherited from previous owners of an installation. The recommendation is that this concept of rigour becomes a part of the way in which safety management systems are scrutinised.

This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents, including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily reflect HSE policy.

RR756

www.hse.gov.uk

prepared by lancaster university for the health and safety executive 2009 · 2019. 12. 5. ·...

Documents